Is CVE-2025-6209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-6209 being exploited in the wild.

How severe is CVE-2025-6209?

Low severity, with a CVSS score of 3, published 7 July 2026.

Which products and versions are affected?

llama-index (PyPI) GIT:introduced=0,fixed=cdeaab91a204d1c3527f177dac37390327aef274|ECOSYSTEM:introduced=0.12.27,fixed=0.12.41; llama-index-core (PyPI) ECOSYSTEM:introduced=0.11.23,fixed=0.12.41.

Is there a fix for CVE-2025-6209?

Yes. llama-index (PyPI): upgrade to 0.12.41 or later; llama-index-core (PyPI): upgrade to 0.12.41 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-6209 attacked?

It is attacked over the network.

Am I affected by CVE-2025-6209?

Check whether you run llama-index (PyPI) or llama-index-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-6209: PYSEC-2026-1558 - LlamaIndex vulnerable to Path Traversal attack through its encode_image function

CVE-2025-6209 · Severity: low · CVSS 3 · Published 2026-07-07

LlamaIndex is a popular Python framework for building applications with large language models. The encode_image function contains a path traversal vulnerability that allows attackers to read arbitrary files from the server by manipulating image file paths, potentially exposing sensitive configuration files and credentials.

Technologies: llama-index (PyPI), llama-index-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-6209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-6209 being exploited in the wild.
How severe is CVE-2025-6209?: Low severity, with a CVSS score of 3, published 7 July 2026.
Which products and versions are affected?: llama-index (PyPI) GIT:introduced=0,fixed=cdeaab91a204d1c3527f177dac37390327aef274|ECOSYSTEM:introduced=0.12.27,fixed=0.12.41; llama-index-core (PyPI) ECOSYSTEM:introduced=0.11.23,fixed=0.12.41.
Is there a fix for CVE-2025-6209?: Yes. llama-index (PyPI): upgrade to 0.12.41 or later; llama-index-core (PyPI): upgrade to 0.12.41 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-6209 attacked?: It is attacked over the network.
Am I affected by CVE-2025-6209?: Check whether you run llama-index (PyPI) or llama-index-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

llama-index (PyPI): upgrade to 0.12.41 or later
```
pip install "llama-index>=0.12.41"
```
llama-index-core (PyPI): upgrade to 0.12.41 or later
```
pip install "llama-index-core>=0.12.41"
```

Technical details

A path traversal vulnerability exists in LlamaIndex versions 0.11.23 through 0.12.40 within the encode_image function in generic_utils.py, caused by improper validation of the image_path input parameter. An attacker can craft malicious image paths using directory traversal sequences (e.g., "../") to access files outside the intended directory without requiring authentication. The vulnerability allows reading arbitrary files on the system with the privileges of the application process. The fix in version 0.12.41 adds image format validation using PIL to ensure the input is actually an image file.

Affected products

LlamaIndex llama-index-core 0.11.23 through 0.12.40

Identifiers

CVE-2025-6209
GHSA-2rhq-96q8-4vjq
PYSEC-2025-65
PYSEC-2026-1558

Timeline

2025-07-07: disclosed
2025-06-03: patched: Version 0.12.41 fixes the vulnerability
2025-07-08: advisory: GitHub security advisory reviewed

References

https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.