Executive brief
LlamaIndex is a popular Python framework for building applications with large language models. The encode_image function contains a path traversal vulnerability that allows attackers to read arbitrary files from the server by manipulating image file paths, potentially exposing sensitive configuration files and credentials.
Technical details
A path traversal vulnerability exists in LlamaIndex versions 0.11.23 through 0.12.40 within the encode_image function in generic_utils.py, caused by improper validation of the image_path input parameter. An attacker can craft malicious image paths using directory traversal sequences (e.g., "../") to access files outside the intended directory without requiring authentication. The vulnerability allows reading arbitrary files on the system with the privileges of the application process. The fix in version 0.12.41 adds image format validation using PIL to ensure the input is actually an image file.
Affected products
- LlamaIndex llama-index-core 0.11.23 through 0.12.40
Timeline
- 2025-07-07: disclosed
- 2025-06-03: patched: Version 0.12.41 fixes the vulnerability
- 2025-07-08: advisory: GitHub security advisory reviewed