{"action":"Upgrade llama-index to 0.12.41 or later.","affected":[{"fixed":"0.12.41","introduced":"0.12.27"}],"component":"llama-index","cve_ids":["CVE-2025-6209"],"ecosystem":"PyPI","epss":0.00621,"exploited":false,"fixed_versions":["0.12.41"],"ghsa_id":"GHSA-2rhq-96q8-4vjq","id":"tcs_01M5KGPT0EB63AE6PPP2FVQ26J","modified_at":"2026-07-07T17:56:51.353114584Z","published_at":"2025-07-07T13:15:28Z","references":["https://osv.dev/vulnerability/PYSEC-2025-65","https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274","https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-65","url":"https://osv.dev/vulnerability/PYSEC-2025-65"},{"source":"nvd","source_id":"CVE-2025-6209","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6209"}],"summary":"A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an att"}