Weaviate OSS CVE-2025-67818

Requires an attacker who can both insert data into Weaviate and have that data processed through the backup-and-restore feature; the malicious entry name uses an absolute path or parent-directory traversal to escape the restore root during a restore operation. Exploitation is limited by the need for high-privilege access (CVSS PR:H) to insert data and to trigger or influence a backup restore, and is confined to the filesystem locations writable within the Weaviate application's privilege scope. It is not a remote-unauthenticated flaw against default configurations - the backup/restore workflow must be in use and the attacker must already be authorized to write data.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.2 (High) is driven by a network attack vector (AV:N), low complexity (AC:L), and full C/I/A impact, but it critically requires high privileges (PR:H) - an attacker must already be able to insert data into Weaviate and initiate/influence a backup restore, which substantially narrows the realistic threat population to authenticated/privileged actors or a chained compromise. The EPSS score is low (0.91%, 59th percentile), indicating low modeled probability of near-term widespread exploitation, which is consistent with a privilege-gated path-traversal flaw rather than a trivially wormable bug. There is no CISA KEV listing and no public proof-of-concept referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The signals are mutually consistent: high CVSS impact but low exploitation probability because of the PR:H precondition. One caveat to verify: the description frames the attacker as someone 'with access to insert data into the database,' and the vector's PR:H reflects that gate - but whether triggering a restore requires the same privilege level as data insertion is not fully clear from the input and should be confirmed with the vendor advisory.

An attacker who already holds privileged access to a Weaviate instance (able to insert data and influence backups) crafts an entry whose name contains an absolute path (e.g., /etc/...) or directory-traversal sequences (../../..). When a backup containing that entry is restored, the restore logic writes outside the intended restore root, creating or overwriting arbitrary files within the Weaviate process's privilege scope - potentially leading to configuration tampering, denial of service, or code execution. No public exploit is identified at the time of analysis.