The vulnerability is a path traversal flaw in the load_prompt() function of text‑generation‑webui. An attacker, without authentication, can provide a crafted request that causes the server to resolve file paths and read any .txt file on the filesystem. The file content is returned verbatim via the API, enabling disclosure of configuration files, credentials, or other sensitive documents. The flaw corresponds to CWE‑22, “Path Traversal.”

The flaw affects installations of oobabooga's text‑generation‑webui that are running any version earlier than 4.3. Users of the open‑source web interface should verify whether their deployment uses an older release and apply the update if possible.

The CVSS v3.1 base score is 5.3, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely using the public API, and no credentials are required. Because any .txt file can be read, the potential damage ranges from partial information disclosure to full compromise of secrets stored in plain text. The flaw has been patched in release 4.3, so applying the update eliminates the risk.