CVE-2026-35484

CVE-2026-35484 is an unauthenticated path traversal vulnerability affecting text-generation-webui versions prior to 4.3. The flaw exists in the load_preset() function, which fails to properly validate file paths, allowing attackers to read arbitrary YAML configuration files from the server filesystem. This exposure is particularly severe because these configuration files often contain sensitive credentials such as passwords, API keys, and database connection strings that are subsequently returned to the attacker in the API response. The vulnerability carries a CVSS v3.1 score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity, making it straightforward to execute. While the primary impact is confidentiality loss through unauthorized information disclosure, there are no associated integrity or availability impacts. Exploitation status indicates this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and appears inactive on threat tracking lists. The EPSS score of 0.000640 suggests minimal current exploitation activity in the wild. However, the relative ease of exploitation and the high-value nature of exposed credentials warrant prompt patching to version 4.3 or later, particularly for instances exposed to untrusted networks.