CVE-2026-35487

TEXT-GENERATION-WEBUI VULNERABILITY BRIEFING OVERVIEW CVE-2026-35487 is an unauthenticated path traversal vulnerability affecting text-generation-webui versions prior to 4.3, an open-source web interface for running Large Language Models. The flaw exists in the load_prompt() function and allows attackers to read arbitrary .txt files from the server filesystem, with file contents returned directly in API responses. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.3 (MEDIUM) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The attack has limited impact, restricted to confidentiality breaches with no integrity or availability implications. The FAUCET Risk Score of 32.0/100 reflects moderate organizational concern, though EPSS scoring indicates this threat ranks below average relative to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as CVE-2026-35487 is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking hot lists. Community attention appears minimal relative to the vulnerability's profile. Organizations running text-generation-webui should prioritize upgrading to version 4.3 or later to remediate unauthorized file access risks.