A path traversal flaw in the load_prompt() procedure of text-generation-webui allows a remote actor to read any .txt file on the server file system without authentication. The content of the targeted file is returned directly in the API response, providing an attacker with plaintext access to potentially sensitive configuration or credential files. The weakness corresponds to the common weakness classification of improper input handling leading to unrestricted file read.

The vulnerability affects all installations of the oobabooga text-generation-webui product that run a version earlier than 4.3. Users operating these older releases are therefore exposed to the risk of unauthorized access to server files via the public API.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score below 1% suggests low current exploit activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can reach the affected functionality through the unauthenticated API endpoint by submitting crafted request parameters that contain directory traversal sequences, allowing them to specify arbitrary file paths.