{"action":"Upgrade llama-index-core to 0.12.41 or later.","affected":[{"fixed":"0.12.41","introduced":"0.11.23"}],"component":"llama-index-core","cve_ids":["CVE-2025-6209"],"ecosystem":"PyPI","epss":0.00621,"exploited":false,"fixed_versions":["0.12.41"],"ghsa_id":"GHSA-2rhq-96q8-4vjq","id":"tcs_01M5KGTABP7Z5EYJRP025HGVPR","modified_at":"2026-07-07T17:56:51.353114584Z","published_at":"2026-07-07T16:02:57.103779Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1558","https://nvd.nist.gov/vuln/detail/CVE-2025-6209","https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274","https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2025-65.yaml","https://github.com/run-llama/llama_index","https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68","https://pypi.org/project/llama-index-core","https://github.com/advisories/GHSA-2rhq-96q8-4vjq"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1558","url":"https://osv.dev/vulnerability/PYSEC-2026-1558"}],"summary":"LlamaIndex vulnerable to Path Traversal attack through its encode_image function"}