A path traversal flaw in SillyTavern’s /api/chats/export and /api/chats/delete endpoints allows an authenticated user to read or delete any file beneath the user’s data root, such as secrets.json and settings.json. The weakness is a file path manipulation vulnerability (CWE-22), granting the attacker compromise of confidential data and the ability to alter or destroy user configuration files.

SillyTavern versions published before 1.17.0, running locally and accessed via the web interface. Any user who can log in to the local instance can exploit the vulnerable endpoints and impact the user’s data directory.

The flaw carries a CVSS score of 8.3, indicating high severity, while the EPSS assessment is below 1%, suggesting a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack requires only a locally authenticated session, so the risk is greatest for users running the application with sufficient privileges, who can trigger the file read or delete operations.