CVE-2025-7647

Katalog CVE

CVSS 7.3 · High EPSS 0,15%

Kerentanan Creation of Temporary File With Insecure Permissions. Skor CVSS 3.0 7.3 (High) menurut huntr.dev.

Deskripsi (NVD)

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `/tmp/llama_index` is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.

Rincian

Terbit di NVD

27 September 2025

Terakhir diubah

9 Oktober 2026

Status NVD

Deferred

CVSS 3.0

7.3 (High), sumber huntr.dev
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-378: Creation of Temporary File With Insecure Permissions

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4
• https://huntr.com/bounties/a2baa08f-98bf-47a8-ac83-06f7411afd9e