An issue was discovered in Weaviate OSS before 1.33.4.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Dec 12, 2025 · NIST NVD

   Detected

   An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.

2. Oct 14, 2026 · NIST NVD

   Updated

   An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.

Affected

• cpe weaviate/weaviateversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-67818

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-67818

  30-day exploitation probability 0.9%

  first.org
• NIST NVDVulnerability recordCVE-2025-67818

  An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potent

  nvd.nist.gov

References

• Product · github.com
• Vendor Advisory · weaviate.io