CVE-2026-35485

OVERVIEW CVE-2026-35485 is a path traversal vulnerability in text-generation-webui versions prior to 4.3, an open-source web interface for running Large Language Models. The flaw exists in the load_grammar() function and allows unauthenticated attackers to read arbitrary files from the server filesystem without extension restrictions. The vulnerability stems from Gradio's failure to perform server-side validation on dropdown values, enabling attackers to submit directory traversal payloads such as ../../../etc/passwd through the API. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, meaning exploitation is straightforward. The impact is limited to confidentiality breach, as attackers can only read files and cannot modify data or disrupt availability. The FAUCET risk score of 48.0 out of 100 indicates moderate risk within the broader vulnerability landscape. EXPLOITATION STATUS The vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no indication of active exploitation in the wild. It remains on an inactive Hot List status. The EPSS score of 0.0048 suggests this vulnerability has a lower probability of exploitation compared to the CVE population baseline. However, organizations running vulnerable versions should prioritize updating to version 4.3 or later to eliminate exposure.