Read the docs
TI-2025-41467 Aliases CVE-2025-67818GHSA-7v39-2hx7-7c43

An issue was discovered in Weaviate OSS before 1.33.4.

Priority LOW 35CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00905 60th percentileScored 2026-11-07
Fix Fixed github.com/weaviate/weaviate (Go): 1.30.20, 1.31.19, 1.32.16 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/weaviate/weaviate (Go)before 1.30.201.30.20Patch availableGHSA-7v39-2hx7-7c43
—github.com/weaviate/weaviate (Go)1.31.0-rc.0 to before 1.31.191.31.19Patch availableGHSA-7v39-2hx7-7c43
—github.com/weaviate/weaviate (Go)1.32.0-rc.0 to before 1.32.161.32.16Patch availableGHSA-7v39-2hx7-7c43
—github.com/weaviate/weaviate (Go)1.33.0-rc.0 to before 1.33.41.33.4Patch availableGHSA-7v39-2hx7-7c43
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/weaviate/weaviate (Go) Vendor— Affected before 1.30.20 Fixed in 1.30.20 Patch available GHSA-7v39-2hx7-7c43
  • github.com/weaviate/weaviate (Go) Vendor— Affected 1.31.0-rc.0 to before 1.31.19 Fixed in 1.31.19 Patch available GHSA-7v39-2hx7-7c43
  • github.com/weaviate/weaviate (Go) Vendor— Affected 1.32.0-rc.0 to before 1.32.16 Fixed in 1.32.16 Patch available GHSA-7v39-2hx7-7c43
  • github.com/weaviate/weaviate (Go) Vendor— Affected 1.33.0-rc.0 to before 1.33.4 Fixed in 1.33.4 Patch available GHSA-7v39-2hx7-7c43

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*before 1.33.4VulnerableWeaviate
  • cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:* Versions before 1.33.4 Vulnerable ·Weaviate

Remediation

  • Fix · GHSA-7v39-2hx7-7c43 github.com/weaviate/weaviate (Go) Fixed in 1.30.20 Advisory →
  • Fix · GHSA-7v39-2hx7-7c43 github.com/weaviate/weaviate (Go) Fixed in 1.31.19 Advisory →
  • Fix · GHSA-7v39-2hx7-7c43 github.com/weaviate/weaviate (Go) Fixed in 1.32.16 Advisory →
  • Fix · GHSA-7v39-2hx7-7c43 github.com/weaviate/weaviate (Go) Fixed in 1.33.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67818
  2. 2026-10-03 Alias added: GHSA-7v39-2hx7-7c43

References

Advisory 3

Other 3

  • TI-2023-20227 An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
  • TI-2026-42273 Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment CVSS 4.0HIGH 8.7
  • TI-2025-41468 An issue was discovered in Weaviate OSS before 1.33.4. CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences