The vulnerability identified as CVE-2026-35487 affects the open-source oobabooga text-generation-webui prior to version 4.3. An unauthenticated path traversal flaw in the load_prompt() function permits attackers to read any .txt file on the server filesystem by manipulating the pathname. The contents of the accessed file are returned verbatim in the API response, potentially exposing sensitive information. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with an attack vector of network, no privileges required, and no user interaction needed. The vulnerability is fixed in version 4.3 of the software.

Successful exploitation allows an unauthenticated attacker to read arbitrary .txt files on the server hosting the vulnerable text-generation-webui instance. This can lead to disclosure of sensitive information stored in text files. There is no impact on integrity or availability according to the CVSS vector. No known exploits in the wild have been reported.

Upgrade to version 4.3 or later of oobabooga text-generation-webui, where this vulnerability is fixed. Since the vulnerability is resolved in the official release, no additional mitigation steps are required beyond applying the update. Patch status is confirmed by the vendor stating the fix is included in version 4.3.