CVE-2025-67818
📋 TL;DR
This vulnerability allows attackers with database write access to craft malicious entry names containing absolute paths or directory traversal sequences. When a backup is restored, these entries can escape the intended restore directory and create/overwrite arbitrary files within the application's privilege scope. Organizations running vulnerable Weaviate OSS versions are affected.
💻 Affected Systems
- Weaviate OSS
📦 What is this software?
Weaviate by Weaviate
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data destruction, or privilege escalation.
Likely Case
Data corruption, service disruption, or sensitive file exposure through crafted backup restoration.
If Mitigated
Limited impact if proper access controls restrict database write permissions and backup restoration is monitored.
🎯 Exploit Status
Exploitation requires two conditions: 1) Database write access 2) Backup restoration operation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.33.4 and later
Vendor Advisory: https://weaviate.io/blog/weaviate-security-release-november-2025
Restart Required: Yes
Instructions:
1. Stop Weaviate service. 2. Update to version 1.33.4 or later. 3. Restart Weaviate service. 4. Verify version with 'weaviate --version'.
🔧 Temporary Workarounds
Restrict Database Write Access
allLimit insert/update permissions to trusted users only.
Configure Weaviate authentication and authorization to restrict write operations
Monitor Backup Operations
allImplement strict controls and monitoring for backup restoration processes.
Audit backup restoration logs for unusual file paths
🧯 If You Can't Patch
- Implement strict access controls to limit who can insert data into the database
- Monitor and audit all backup restoration operations for suspicious file paths
🔍 How to Verify
Check if Vulnerable:
Check Weaviate version: if version is less than 1.33.4, system is vulnerable.Check Version:
weaviate --versionVerify Fix Applied:
Confirm version is 1.33.4 or higher and test backup restoration with malicious path entries.📡 Detection & Monitoring
Log Indicators:
- Unusual file paths in backup restoration logs
- Database entries containing absolute paths or '..' sequences
Network Indicators:
- Unusual backup restoration requests
- Excessive database write operations from single source
SIEM Query:
source="weaviate" AND ("backup restore" OR "restoration") AND (".." OR "/etc/" OR "/root/")