CVE-2025-6209

Affected versions of the LlamaIndex package are vulnerable to Path Traversal. The `encode_image()` function in `generic_utils.py` fails to properly validate and sanitize file path inputs, leading to unauthorized file access. An attacker can exploit this vulnerability by manipulating the `image_path` parameter with path traversal sequences, resulting in the ability to read arbitrary files on the server, including sensitive system files. The vulnerability was fixed in version 0.12.41 through the implementation of path validation checks. The fix adds the `is_valid_path()` and `is_valid_url()` functions to validate input paths and URLs.