The oobabooga text-generation-webui before version 4.3 contains an unauthenticated path traversal vulnerability in the load_preset() function. This flaw permits attackers to specify arbitrary file paths to .yaml files on the server, bypassing intended directory restrictions. The contents of these YAML files, which may include sensitive configuration data like passwords and API keys, are parsed and returned in API responses, potentially exposing confidential information. The vulnerability is addressed in version 4.3 of the software.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive configuration data stored in YAML files on the server, including passwords, API keys, and connection strings. This exposure can compromise the confidentiality of the system and any integrated services relying on these credentials. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Upgrade to version 4.3 or later of the oobabooga text-generation-webui, where this vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 4.3, applying this official fix is the recommended remediation. Patch status is not explicitly stated beyond this, so verify with the vendor for any additional guidance.