CVE-2025-67819

CVE-2025-67819 describes an arbitrary file read vulnerability in Weaviate OSS versions prior to 1.33.4. An authenticated attacker with high privileges can exploit a lack of validation in the fileName field within the transfer logic of the GetFile method. This allows them to read any file accessible to the service process when a shard is paused and the FileReplicationService is reachable. The vulnerability carries a CVSS score of 4.9 MEDIUM, indicating a network-based attack with low complexity, requiring high privileges, but resulting in high confidentiality impact without affecting integrity or availability. While the EPSS score is low, suggesting minimal current exploitation, the FAUCET Risk Score of 63/100 highlights its potential. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, aligning with typical trends for newly disclosed vulnerabilities.