The text-generation-webui project, an open-source web interface for Large Language Models, contained a path traversal vulnerability (CWE-22) in the load_grammar() function prior to version 4.3. Due to insufficient validation of user input in Gradio's dropdown values, an attacker can submit directory traversal strings (e.g., ../../../etc/passwd) via the API without authentication. This allows reading any file on the server filesystem without extension restrictions. The vulnerability was publicly disclosed with a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is fixed in version 4.3.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server hosting text-generation-webui, potentially exposing sensitive information. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no known exploits in the wild at the time of disclosure.

Upgrade to text-generation-webui version 4.3 or later, where this path traversal vulnerability is fixed. Since no official patch or temporary workaround details are provided, updating to the fixed version is the recommended remediation. Patch status is not explicitly confirmed beyond the fix in version 4.3, so users should verify with the vendor or project repository for the latest guidance.