PYSEC-2026-1567
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/llama-index-readers-obsidian/PYSEC-2026-1567.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1567
- Aliases
- Published
- 2026-07-07T16:02:56.964090Z
- Modified
- 2026-07-13T07:26:33.207198286Z
- Severity
-
- 6.2 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit
- Details
-
A vulnerability in the ObsidianReader class of the run-llama/llamaindex repository, before version 0.5.2 (specifically in version 0.12.27 of llama-index), allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The vulnerability arises from inadequate handling of hardlinks in the loaddata() method, where the security checks fail to differentiate between real files and hardlinks. This issue is resolved in llama-index-readers-obsidian version 0.5.2.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2025-6210
- https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff
- https://github.com/run-llama/llama_index
- https://huntr.com/bounties/a654b322-a509-4448-a1f5-0f22850b4687
- https://pypi.org/project/llama-index-readers-obsidian
- https://github.com/advisories/GHSA-3j8r-jf9w-5cmh
Affected packages
PyPI / llama-index-readers-obsidian
Package
- Name
- llama-index-readers-obsidian
- View open source insights on deps.dev
- Purl
- pkg:pypi/llama-index-readers-obsidian