Advisoriesby IbisSillyTavern: Path Traversal allows file existence oracle
Summary
A path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server's filesystem. By sending percent-encoded ../ sequences (%2E%2E%2F) in requests to static file routes, an attacker can check for the existence of files (404 if it doesn't exist, 403 means it exists).
Details
The vulnerability is in createRouteHandler (src/users.js:947–963), which backs all user-data static file routes:
```javascript
function createRouteHandler(directoryFn) {
return async (req, res) => {
const directory = directoryFn(req);
const filePath = decodeURIComponent(req.params[0]);
const exists = fs.existsSync(path.join(directory, filePath)); // no boundary check here
if (!exists) {
return res.sendStatus(404);
}
return res.sendFile(filePath, { root: directory });
};
}
`
req.params[0] contains the raw (percent-encoded) wildcard from the URL. After decodeURIComponent, a request path like /characters/%2E%2E%2F%2E%2E%2FUsers/kirakira decodes to ../../Users/kirakira, and path.join resolves it outside the intended directory. res.sendFile correctly blocks the file from being served (the send module's root check returns 403), but fs.existsSync had already run, and the 403/404 distinction reveals the result....
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| sillytavern npm | < 1.17.0 | 1.17.0 |
Details and references
### Summary A path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server's filesystem. By sending percent-encoded `../` sequences (`%2E%2E%2F`) in requests to static file routes, an attacker can check for the existence of files (404 if it doesn't exist, 403 means it exists). ### Details The vulnerability is in `createRouteHandler` (`src/users.js:947–963`), which backs all user-data static file routes: ```javascript function createRouteHandler(directoryFn) { return async (req, res) => { const directory = directoryFn(req); const filePath = decodeURIComponent(req.params[0]); const exists = fs.existsSync(path.join(directory, filePath)); // no boundary check here if (!exists) { return res.sendStatus(404); } return res.sendFile(filePath, { root: directory }); }; } ``` `req.params[0]` contains the raw (percent-encoded) wildcard from the URL. After `decodeURIComponent`, a request path like `/characters/%2E%2E%2F%2E%2E%2FUsers/kirakira` decodes to `../../Users/kirakira`, and `path.join` resolves it outside the intended directory. `res.sendFile` correctly blocks the file from being served (the `send` module's root check returns 403), but `fs.existsSync` had already run, and the 403/404 distinction reveals the result. Affected routes (they all use the same handler, so they're all affected): - `/characters/*` - `/user/files/*` - `/assets/*` - `/user/images/*` - `/backgrounds/*` - `/User%20Avatars/*` ### PoC ```bash curl -o /dev/null -s -w "%{http_code}\n" "http://localhost:8000/characters/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2FUsers/kirakira/something" ``` ### Impact While file contents cannot be read (the `send` module blocks actual delivery), anyone who can reach the SillyTavern HTTP port can check the existence of files on the host filesystem. ### Resolution The issue was addressed in version 1.17.0.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-34523
More SillyTavern advisories
All SillyTavern
SillyTavern has a Path Traversal issueCVE-2026-44650fixed in 1.18.0SillyTavern has Authentication Bypass via SSO Header InjectionCVE-2026-44649fixed in 1.18.0SillyTavern: insufficient session expirationCVE-2026-44648fixed in 1.18.0SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6CVE-2026-34526fixed in 1.17.0SillyTavern: path traversalCVE-2026-34524fixed in 1.17.0SillyTavern: path traversalCVE-2026-34522fixed in 1.17.0