Skip to content
OpenAdvisories

Package · Go

github.com/weaviate/weaviate

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.0
    CVE-2026-11500

    Weaviate Static API Key client.go validateConfig authorization

    A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey/client.go of the component Static API Key Handler. The manipulation of the argument StaticApiKey le…

    github.com/weaviate/weaviate Go
  • Medium 4.9
    CVE-2025-67819

    Weaviate OSS has path traversal vulnerability via the Shard Movement API

    An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is r…

    github.com/weaviate/weaviate Go
  • High 7.2
    CVE-2025-67818

    Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

    An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backu…

    github.com/weaviate/weaviate Go
  • High 7.5
    CVE-2023-38976

    Weaviate denial of service vulnerability

    An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.

    github.com/weaviate/weaviate Go