The vulnerability identified as CVE-2026-35487 affects oobabooga's text-generation-webui versions before 4.3. It is a CWE-22 path traversal issue where the load_prompt() function does not properly restrict pathname inputs, enabling unauthenticated users to read any .txt file on the server filesystem. The file content is exposed verbatim in the API response, potentially leaking sensitive information. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its network accessibility and lack of required privileges or user interaction. The issue is resolved in version 4.3 of the software.

An attacker can read arbitrary .txt files on the server hosting the vulnerable text-generation-webui, potentially exposing sensitive information contained in those files. There is no impact on integrity or availability reported. The vulnerability is exploitable remotely without authentication.

Upgrade to text-generation-webui version 4.3 or later, where this path traversal vulnerability is fixed. Since the vulnerability is resolved in the official release, applying this update fully mitigates the risk. No other temporary fixes or workarounds are documented.