A path traversal flaw in SillyTavern’s static file handler lets an unauthenticated user send percent‑encoded '../' sequences to probe file existence. The flaw creates a file existence oracle that can reveal whether arbitrary files are present on the server. While it does not allow modifications or code execution, the disclosed information could assist attackers in planning further exploits by identifying sensitive files.

Any instance of SillyTavern before version 1.17.0 is affected. The vulnerability resides in the static file routing component of the locally installed user interface that serves content for text, image, and voice generation models.

The flaw has a CVSS score of 5.3, indicating moderate severity. Exploit probability data is not publicly available, and the issue does not appear in major vulnerability catalogs. The attack surface is the web interface; any client that can reach the application’s static routes can craft requests, meaning local or remote users with access to the HTTP service could exploit the vulnerability.