CVE-2025-67819

Description

Weaviate OSS has path traversal vulnerability via the Shard Movement API in github.com/weaviate/weaviate

How to fix CVE-2025-67819

To remediate CVE-2025-67819, upgrade the affected package to a fixed version below.

• Go/github.com/weaviate/weaviate—upgrade to 1.30.20 or later
• Go/github.com/weaviate/weaviate—upgrade to 1.30.20 or later

Is CVE-2025-67819 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 1.30.0, < 1.30.20
• >= 1.30.0, < 1.30.20, >= 1.31.0-rc.0, < 1.31.19, >= 1.32.0-rc.0, < 1.32.16, >= 1.33.0-rc.0, < 1.33.4

CVSS scores

References (7)

• ADVISORYgithub.com/advisories/GHSA-hmmh-292h-3364
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-67819
• PATCHgithub.com/weaviate/weaviate
• WEBgithub.com/weaviate/weaviate/commit/4ff2cc89277c264c37d0f7316d9eb6368cfc30ff