CVE-2025-67818

Description

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate

How to fix CVE-2025-67818

To remediate CVE-2025-67818, upgrade the affected package to a fixed version below.

• Go/github.com/weaviate/weaviate—upgrade to 1.30.20 or later
• Go/github.com/weaviate/weaviate—upgrade to 1.30.20 or later

Is CVE-2025-67818 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.30.20
• from 0, < 1.30.20, >= 1.31.0-rc.0, < 1.31.19, >= 1.32.0-rc.0, < 1.32.16, >= 1.33.0-rc.0, < 1.33.4

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-7v39-2hx7-7c43
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-67818
• PATCHgithub.com/weaviate/weaviate
• WEBgithub.com/weaviate/weaviate/commit/169df2dc92bc232df62e8fab0a20db2e5371f7aa