# CVE-2025-6209: PYSEC-2026-1558 - LlamaIndex vulnerable to Path Traversal attack through its encode_image function

Source: https://junglewise.ai/threats/cve-2025-6209-llamaindex-path-traversal-in-encode-image-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-6209 · Severity: low · CVSS 3 · Published 2026-07-07

LlamaIndex is a popular Python framework for building applications with large language models. The encode_image function contains a path traversal vulnerability that allows attackers to read arbitrary files from the server by manipulating image file paths, potentially exposing sensitive configuration files and credentials.

Technologies: [llama-index (PyPI)](https://junglewise.ai/threats/technologies/llama-index), [llama-index-core (PyPI)](https://junglewise.ai/threats/technologies/llama-index-core). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-6209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-6209 being exploited in the wild.

**How severe is CVE-2025-6209?** Low severity, with a CVSS score of 3, published 7 July 2026.

**Which products and versions are affected?** llama-index (PyPI) GIT:introduced=0,fixed=cdeaab91a204d1c3527f177dac37390327aef274|ECOSYSTEM:introduced=0.12.27,fixed=0.12.41; llama-index-core (PyPI) ECOSYSTEM:introduced=0.11.23,fixed=0.12.41.

**Is there a fix for CVE-2025-6209?** Yes. llama-index (PyPI): upgrade to 0.12.41 or later; llama-index-core (PyPI): upgrade to 0.12.41 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-6209 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-6209?** Check whether you run llama-index (PyPI) or llama-index-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- llama-index (PyPI): upgrade to 0.12.41 or later

  ```sh
  pip install "llama-index>=0.12.41"
  ```

- llama-index-core (PyPI): upgrade to 0.12.41 or later

  ```sh
  pip install "llama-index-core>=0.12.41"
  ```


## Technical details

A path traversal vulnerability exists in LlamaIndex versions 0.11.23 through 0.12.40 within the encode_image function in generic_utils.py, caused by improper validation of the image_path input parameter. An attacker can craft malicious image paths using directory traversal sequences (e.g., "../") to access files outside the intended directory without requiring authentication. The vulnerability allows reading arbitrary files on the system with the privileges of the application process. The fix in version 0.12.41 adds image format validation using PIL to ensure the input is actually an image file.

## Affected products

- LlamaIndex llama-index-core 0.11.23 through 0.12.40

## Identifiers

- CVE-2025-6209
- GHSA-2rhq-96q8-4vjq
- PYSEC-2025-65
- PYSEC-2026-1558

## Timeline

- 2025-07-07: disclosed
- 2025-06-03: patched: Version 0.12.41 fixes the vulnerability
- 2025-07-08: advisory: GitHub security advisory reviewed

## References

- [https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274](https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274)

## Related threats

- [PYSEC-2026-2606 - LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class](https://junglewise.ai/threats/cve-2025-6211-llamaindex-vulnerable-to-data-loss-through-hash-collisions-in-its)
- [PYSEC-2026-1560 - llama-index-core vulnerable to Uncontrolled Resource Consumption](https://junglewise.ai/threats/cve-2025-6208-llama-index-core-vulnerable-to-uncontrolled-resource-consumption)
- [PYSEC-2026-1562 - llama-index-core insecurely handles temporary files](https://junglewise.ai/threats/cve-2025-7647-llama-index-core-insecurely-handles-temporary-files)
- [PYSEC-2026-1561 - LlamaIndex affected by a Denial of Service (DOS) in JSONReader](https://junglewise.ai/threats/cve-2025-5302-llamaindex-affected-by-a-denial-of-service-dos-in-jsonreader)
- [PYSEC-2026-1559 - LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing](https://junglewise.ai/threats/cve-2025-5472-llamaindex-vulnerable-to-dos-attack-through-uncontrolled-recursive)