9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44650

CVE-2026-44650: SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in the default configuration. This vulnerability is fixed in 1.18.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44650

CVE-2026-44650:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sillytavern	npm	<= 1.17.0	1.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several Express.js route handlers within src/endpoints/extensions.js. The core issue is a path traversal vulnerability stemming from improper handling of the extensionName parameter in the request body. The application used a weak check (if (!request.body.extensionName)) to validate the extensionName. A malicious user could provide . as the extensionName. This value is truthy and passes the check. Subsequently, the sanitize-filename library, when processing . returns an empty string. When this empty string is used with path.join(basePath, ''), the result is the basePath itself. This allowed an attacker to perform actions, such as deletion, on the parent directory (extensions) instead of a specific extension's subdirectory. The patch addresses this by checking the result of the sanitization, ensuring that an empty sanitized name is rejected. This vulnerability affected the /api/extensions/delete, /api/extensions/update, /api/extensions/branches, /api/extensions/switch, and /api/extensions/version endpoints.

Vulnerable functions

router.post('/delete')

src/endpoints/extensions.js

The function was vulnerable to path traversal because it did not properly sanitize the `extensionName` parameter. An input of `.` would pass the initial truthy check, but `sanitize('.')` would return an empty string. This caused `path.join` to resolve to the base directory, leading to the deletion of the entire extensions directory.

router.post('/update')

src/endpoints/extensions.js

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.