CVE-2025-7647

Advisory

Affected versions of the llama-index-core package are vulnerable to Insecure Temporary File handling due to use of a predictable, world-accessible cache directory on multi-user Linux systems. The get_cache_dir() function uses the hardcoded path /tmp/llama_index without appropriate security controls (e.g., safe permissions or exclusive creation), enabling unsafe temporary-directory usage and race conditions.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://huntr.com/bounties/a2baa08f-98bf-47a8-ac83-06f7411afd9e
• https://github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4
• https://github.com/advisories/GHSA-cr7q-2w66-hjcm
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7647