CVE-2025-67819: 
NixOS vulnerability analysis and mitigation

CVE-2025-67819 is a path traversal vulnerability in Weaviate OSS (open-source vector database) that allows attackers to read arbitrary files accessible to the service process via the Shard Movement API. The flaw was published on December 12, 2025, and affects versions 1.30.0–1.30.19, 1.31.0–1.31.18, 1.32.0–1.32.15, and 1.33.0–1.33.3. It carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): the fileName field in the FileReplicationService's transfer logic is not validated or sanitized before being used to construct file paths. An attacker can exploit this by calling the GetFile method while a target shard is in the "Pause file activity" state and the FileReplicationService endpoint is network-reachable, supplying path traversal sequences (e.g., ../../) in the fileName parameter to escape the intended directory and access arbitrary files on the host. The CVSS v4.0 scoring assigns no privilege requirement, suggesting the internal service endpoint may be reachable without authentication in certain deployment configurations, though the CVSS v3.1 score reflects a high-privilege precondition (GitHub Advisory, Feedly).

Successful exploitation results in unauthorized disclosure of arbitrary files readable by the Weaviate service process, including sensitive configuration files, credentials, API keys, or internal data. There is no integrity or availability impact — the vulnerability is purely a confidentiality breach. In environments where Weaviate runs with broad filesystem permissions, the scope of exposed data could be significant, potentially enabling further lateral movement if credentials or secrets are extracted (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.049% (per Feedly data) to 0.237% (per GitHub Advisory), placing it in the lower-to-mid range of exploitation likelihood. No threat actor attribution has been reported.

1. Reconnaissance: Identify Weaviate OSS instances running affected versions (1.30.0–1.30.19, 1.31.0–1.31.18, 1.32.0–1.32.15, 1.33.0–1.33.3) with the FileReplicationService endpoint exposed on the network.
2. Trigger shard pause: Using a high-privilege account (or exploiting a misconfiguration where the service is unauthenticated), initiate a shard movement operation to place the target shard into the "Pause file activity" state.
3. Craft malicious GetFile request: Call the GetFile method on the FileReplicationService, supplying a path traversal payload in the fileName field (e.g., ../../../../etc/passwd or ../../../../proc/self/environ) to escape the intended data directory.
4. Retrieve arbitrary files: The service returns the contents of the targeted file without validation, allowing the attacker to read sensitive files accessible to the Weaviate process, such as configuration files, secrets, or credentials.
5. Leverage disclosed data: Use any extracted credentials, API keys, or configuration details for further access or lateral movement within the environment (GitHub Advisory).

• Network: Unusual or repeated requests to the Weaviate FileReplicationService gRPC endpoint containing path traversal sequences (../, ..%2F, %2e%2e%2f) in the fileName parameter; unexpected outbound connections from the Weaviate host following service access.
• Logs: Weaviate service logs showing GetFile method calls with non-standard or suspicious fileName values (e.g., paths referencing /etc/, /proc/, or other system directories); access log entries for the replication service during shard pause states.
• File System: No direct file system artifacts are expected from read-only exploitation, but review of recently accessed sensitive files (via auditd or similar) may reveal unauthorized reads by the Weaviate process.
• Process: Weaviate service process accessing files outside its designated data directory, detectable via auditd file access rules or eBPF-based monitoring tools.

Weaviate has released patched versions addressing this vulnerability: 1.30.20, 1.31.19, 1.32.16, and 1.33.4. Users should upgrade to the appropriate patched release immediately. As interim mitigations, restrict network access to the FileReplicationService endpoint using firewall rules or network segmentation, enforce strict access controls on high-privilege accounts, and apply the principle of least privilege to the Weaviate service account to minimize the impact of any file disclosure (GitHub Advisory, Weaviate Security Blog).

Weaviate published a security release blog post addressing this and related vulnerabilities (Weaviate Security Blog). The vulnerability received standard coverage from vulnerability tracking services including INCIBE-CERT, VulnDB, and ENISA's EUVD. No notable independent researcher commentary or significant social media discussion has been identified beyond automated CVE tracking posts.