{
 "id": "AIR-2025-0037",
 "slug": "cve-2025-67819-weaviate-arbitrary-file-read-vulnerability",
 "title": "CVE-2025-67819: Weaviate Arbitrary File Read Vulnerability",
 "summary": "Weaviate OSS before version 1.33.4 lacks proper filename validation during file transfer logic. This allows attackers able to call the GetFile method to read arbitrary files accessible to the service process.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Weaviate OSS"
 ],
 "incident_date": "2025-12-12",
 "incident_date_precision": "day",
 "first_reported": "2025-12-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67819",
   "publisher": "NVD",
   "title": "CVE-2025-67819: An issue was discovered in Weaviate OSS before 1.33.4.",
   "published_at": "2025-12-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2025-67819",
  "infra_vuln"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}