CVE-2025-3046
3 advisories.
PyPI/llama-index-readers-obsidian CVE-2025-3046: high 7.5
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class
Action: Upgrade llama-index-readers-obsidian to 0.5.1 or later.
pip install llama-index-readers-obsidian==0.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.1 | - |
Fixed versions
| 0.5.1 |
Sources
- osv: GHSA-fmrf-6jv9-qjc7
- https://nvd.nist.gov/vuln/detail/CVE-2025-3046
- https://github.com/run-llama/llama_index/pull/18320
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
- https://github.com/run-llama/llama_index/commit/266eb3b3a61f158112726d75a5f5f0b90e34ded0
- https://github.com/run-llama/llama_index
- https://huntr.com/bounties/90a1f1b2-bb82-4d66-9fc1-856ed5f904da
CVE-2025-3046 · published · modified · JSON
PyPI/llama-index CVE-2025-3046: high 7.5
A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The `ObsidianReader` fails to
Action: Upgrade llama-index to 0.12.28 or later.
pip install llama-index==0.12.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.23 | 0.12.28 | - |
Fixed versions
| 0.12.28 |
Sources
- osv: PYSEC-2025-248
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
- https://huntr.com/bounties/90a1f1b2-bb82-4d66-9fc1-856ed5f904da
CVE-2025-3046 · published · modified · JSON
PyPI/llama-index-readers-obsidian CVE-2025-3046: high 7.5
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class
Action: Upgrade llama-index-readers-obsidian to 0.5.1 or later.
pip install llama-index-readers-obsidian==0.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.1 | - |
Fixed versions
| 0.5.1 |
Sources
- osv: PYSEC-2026-1568
- https://nvd.nist.gov/vuln/detail/CVE-2025-3046
- https://github.com/run-llama/llama_index/pull/18320
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
- https://github.com/run-llama/llama_index/commit/266eb3b3a61f158112726d75a5f5f0b90e34ded0
- https://github.com/run-llama/llama_index
- https://huntr.com/bounties/90a1f1b2-bb82-4d66-9fc1-856ed5f904da
- https://pypi.org/project/llama-index-readers-obsidian
- https://github.com/advisories/GHSA-fmrf-6jv9-qjc7
CVE-2025-3046 · published · modified · JSON