CVE-2025-67819
An issue was discovered in Weaviate OSS before 1.33.4.
Published Dec 12, 2025 · updated Oct 14, 2026 · weaviate weaviate
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 12, 2025 · NIST NVD
Detected
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
Oct 14, 2026 · NIST NVD
Updated
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
Affected
- cpe weaviate/weaviateversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-67819
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-67819
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2025-67819
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arb
nvd.nist.gov