CRITICAL9.8CVE-2026-44649SillyTavern has Authentication Bypass via SSO Header Injection from 0, < 1.18.0
CRITICAL9.6CVE-2025-59159SillyTavern Web Interface Vulnerable DNS Rebinding from 0, < 1.13.4
from 0, < 1.18.0
HIGH8.5SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
from 0, < 1.18.0
HIGH8.3SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
from 0, < 1.17.0
HIGH8.1SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
from 0, < 1.17.0
HIGH7.5SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
from 0, < 1.18.0
MEDIUM5.3SillyTavern: Path Traversal allows file existence oracle
from 0, < 1.17.0
MEDIUM5.0SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
from 0, < 1.17.0
—SillyTavern has a SSRF vulnerability in the CORS proxy middleware
from 0, < 1.18.0
—SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
from 0, < 1.18.0