CVE-2025-3046 - CVE House
Back to Database
Status published High CVE-2025-3046

Path Traversal via Symbolic Links in run-llama/llama_index

Vulnerability Description

A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The `ObsidianReader` fails to resolve symlinks to their real paths and does not validate whether the resolved paths lie within the intended directory. This flaw enables attackers to place symlinks pointing to files outside the vault directory, which are then processed as valid Markdown files, potentially exposing sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3046

Credits & Attribution

No credits recorded in the NVD database.

References

More from run-llama

View All →
CVE-2025-7707
World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
High 7.1
CVE-2025-7647
Insecure Temporary File Handling in run-llama/llama_index
High 7.3
CVE-2025-6211
MD5 Hash Collision in run-llama/llama_index
Medium 6.5
CVE-2025-6210
Hardlink-Based Path Traversal in run-llama/llama_index
Medium 6.2
CVE-2025-6209
Arbitrary File Read through Path Traversal in run-llama/llama_index
High 7.5

Affected Vendor

Affected Software

run-llama/llama_index
Vulnerable Versions:
unspecified

Timeline

Official Publish: July 7th, 2025
Last Modified: July 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact