Medium 6.2Published Jul 7, 2025

CVE-2025-6210Hardlink-Based Path Traversal in run-llama/llama_index

Updated under an hour ago (Oct 27, 2026, 3:50 AM ET)

Does this affect you?

It affects run-llama/llama_index and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for run-llama/llama_index

Exploited in the last 30 days

A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The vulnerability arises from inadequate handling of hardlinks in the load_data() method, where the security checks fail to differentiate between real files and hardlinks. This issue is resolved in version 0.5.2.

CVSS: 6.2 MEDIUM (v3.0, CNA)CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: @huntr_ai
NVD analysis: Analyzed
Record last updated: Jul 7, 2025
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

run-llama run-llama/llama_index run_llama:llama_index (from the name)	from unspecified before 0.5.2	CNA record
llamaindex llamaindex llamaindex:llamaindex	before 0.5.2	NVD

References

References

https://huntr.com/bounties/a654b322-a509-4448-a1f5-0f22850b4687	exploit, third-party-advisory
https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.