CVE-2026-34524

CVE-2026-34524 is a high-severity path traversal vulnerability affecting SillyTavern versions prior to 1.17.0. This flaw allows an authenticated attacker to read and delete arbitrary files, such as sensitive configuration data, from the user's data root by manipulating chat endpoint parameters. With a CVSS score of 8.3 (High), the vulnerability has a network attack vector, low attack complexity, and requires low privileges, leading to high confidentiality and integrity impacts. There is currently no evidence of active exploitation, nor are public exploit modules available, and community discussion remains minimal.