SillyTavern Path Traversal in Chat Import API
Overview
SillyTavern, a local UI for interacting with LLMs and other AI models, suffers from a critical path traversal vulnerability in its `/api/chats/import` endpoint. This vulnerability, present in versions prior to 1.17.0, allows an authenticated attacker to exploit the `character_name` parameter. By injecting directory traversal sequences (e.g., `../`) into this parameter, an attacker can manipulate the file path where chat data is imported. This enables them to write arbitrary files to locations outside the designated chats directory on the server's filesystem. Such an attack could lead to the overwriting of sensitive system files, the injection of malicious scripts, or other forms of unauthorized file manipulation, significantly compromising the security and integrity of the SillyTavern installation and potentially the underlying host system. The vulnerability requires an attacker to be authenticated within SillyTavern to exploit it.
Affected Systems
Testing Guide
1. Ensure you have an authenticated session in SillyTavern (version prior to 1.17.0). 2. Use a tool like `curl` or Postman to send a POST request to the `/api/chats/import` endpoint. 3. In the request body, provide a JSON payload where the `character_name` field contains a path traversal sequence followed by a filename (e.g., `"../malicious_file.txt"`). 4. Attempt to write to a known location on the filesystem outside the intended chat directory (e.g., `/tmp/test_write.txt` or a user-specific directory). 5. Verify if a file with the specified name is created or overwritten at the target location.
Mitigation Steps
- Update SillyTavern to version 1.17.0 or later. - Restrict access to the SillyTavern API endpoint to only trusted internal networks if possible. - Implement input validation on the `character_name` parameter to sanitize traversal sequences. - Regularly review system logs for suspicious file write activities originating from SillyTavern.
Patch Details
Version 1.17.0