Description
A path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server’s filesystem. By sending percent-encoded ../ sequences (%2E%2E%2F) in requests to static file routes, an attacker can check for the existence of files (404 if it doesn’t exist, 403 means it exists).
Recommendation
Update the sillytavern package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.16.0
- Patched version(s): 1.17.0
References
Could your website be exposed too?
SmartScanner can check your website for SillyTavern: Path Traversal allows file existence oracle and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- SillyTavern has a Path Traversal issue - CVE-2026-44650
You might also like:
See something that needs correcting? Let us knowUpdated April 06, 2026