CVE-2025-7707 - CVE House
Back to Database
Status published High CVE-2025-7707

World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index

Vulnerability Description

The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-7707

Credits & Attribution

No credits recorded in the NVD database.

References

More from run-llama

View All →
CVE-2025-7647
Insecure Temporary File Handling in run-llama/llama_index
High 7.3
CVE-2025-6211
MD5 Hash Collision in run-llama/llama_index
Medium 6.5
CVE-2025-6210
Hardlink-Based Path Traversal in run-llama/llama_index
Medium 6.2
CVE-2025-6209
Arbitrary File Read through Path Traversal in run-llama/llama_index
High 7.5
CVE-2025-6208
Uncontrolled Memory Consumption in run-llama/llama_index
Medium 5.3

Affected Vendor

Affected Software

run-llama/llama_index
Vulnerable Versions:
unspecified

Timeline

Official Publish: October 13th, 2025
Last Modified: October 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-377

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.