CVE-2026-44650 SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An unauthenticated attacker can delete the entire user extensions directory by sending a crafted request to the SillyTavern API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44650?
CVE-2026-44650 is a critical path traversal vulnerability in SillyTavern, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in the default configuration. This vulnerability is fixed in 1.18.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-44650?
2 open source packages ship an affected version, including sillytavern.
| Package | Affected | Fixed in |
|---|---|---|
sillytavern npm | All versions | 1.18.0 |
sillytavern npm | All versions | 1.18.0 |
How do I fix CVE-2026-44650?
Upgrade sillytavern to 1.18.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44650 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44650 exists.
Sources
Also known as GHSA-886q-f44j-h6wh.