CVE-2025-3046: LlamaIndex ObsidianReader Path Traversal Vulnerability
Summary
CVE-2025-3046: LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class. Affects llama-index-readers-obsidian versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Also tracked for
- llama-index · PyPI
The same CVE-2025-3046 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LlamaIndex is an open-source framework designed for building applications that utilize large language models. It provides various integrations, including the ObsidianReader, which allows users to read and process Markdown files from their Obsidian vaults. The ObsidianReader is intended to enhance the usability of LlamaIndex by enabling seamless access to user-generated content. However, a critical vulnerability has been identified in this component, which could lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability in the ObsidianReader class arises from its failure to properly resolve symbolic links to their actual paths. This oversight allows attackers to create symlinks that point to files outside the designated vault directory. When these symlinks are processed as valid Markdown files, it can lead to arbitrary file reads, potentially exposing sensitive information stored on the system. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), and it poses a high severity risk with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.5.1
This is the first release that contains the fix.
pip install --upgrade "llama-index-readers-obsidian==0.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using symbolic links in their Markdown files until the package is updated. Additionally, ensure that the files being processed are strictly contained within the vault directory to mitigate the risk of unauthorized access.
Conclusion
The vulnerability identified as CVE-2025-3046 in the LlamaIndex ObsidianReader class poses a significant risk due to improper handling of symbolic links. Users are strongly advised to update to the patched version to mitigate potential data exposure. For those unable to update immediately, implementing the suggested workarounds can help reduce risk.
See every vulnerability recorded for llama-index-readers-obsidian →
FAQ
The vulnerability allows for arbitrary file reads through symbolic links due to improper path resolution in the ObsidianReader class.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Attackers could access sensitive files outside the intended directory, leading to data exposure and privacy breaches.
Yes, a patch is available in version 0.5.1 and later of the llama-index-readers-obsidian package.
As a temporary measure, avoid using symbolic links and ensure that all files processed are within the vault directory.
References
Related vulnerabilities
Recent vulnerabilities recorded for llama-index-readers-obsidian.
