Weaviate CVE-2025-67819

Exploitation requires three concrete, simultaneous conditions drawn from the description: (1) the attacker must be able to call the GetFile method of the FileReplicationService, (2) a target shard must currently be in the 'Pause file activity' state, and (3) the FileReplicationService must be network-reachable to the attacker. Per the CVSS vector, PR:H means high privileges are required (authenticated with elevated access), which is the primary limiting factor; UI:N means no user interaction is needed. The transient 'Pause file activity' shard state further narrows the exploitation window, making opportunistic mass exploitation unlikely. Affected deployments are Weaviate OSS before 1.33.4; upgrading to 1.33.4 or later removes the condition.

This is a medium-severity information-disclosure flaw (CVSS 4.9) whose real-world risk is materially constrained by its preconditions. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates network reach but requires HIGH privileges (PR:H) and, per the description, an additional environmental condition: the targeted shard must be in the 'Pause file activity' state and the FileReplicationService must be reachable to the attacker. Impact is confidentiality-only (C:H) - arbitrary file read with no integrity or availability effect. The supporting signals all point to low-to-moderate priority: EPSS is 0.50% (41st percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. No SSVC decision record was supplied. The signals are internally consistent - a high-privilege, condition-dependent path-traversal read is plausibly high-CVSS-impact on confidentiality but low likelihood of mass exploitation. Note one tension worth verifying: AC:L (low complexity) sits alongside a description that requires a transient operational state ('Pause file activity'), which arguably raises attack complexity/requirements; the scorer treated the condition as not complexity-increasing. Treat this as a patch-in-normal-cycle item rather than an emergency, prioritizing instances where untrusted parties can reach the FileReplicationService.

An attacker who already holds high-privilege access and can reach the FileReplicationService waits for (or induces) a shard to enter the 'Pause file activity' state, then invokes the GetFile method with a crafted fileName value containing path-traversal sequences. Because the fileName field is not validated, the service returns the contents of arbitrary files readable by the Weaviate process (e.g., configuration, credentials, or data on the host). No public exploit code was identified at the time of analysis, so this is a conceptual chain based on the described defect.