External risk intelligence

SillyTavern Extension Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-44650

SillyTavern is designed as a locally installed, personal-use interface for interacting with LLMs and generative models. It is typically run on a local machine for individual user access rather than as a public-facing network service, making internet exposure via this interface uncharacteristic of its intended deployment pattern.

Path Traversal

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in SillyTavern, a user interface for AI models. An unauthenticated attacker could potentially delete user-installed extensions on the affected system. The main concern is confirming relevance and exposure, as the tool is designed for local use.

Sensitive files can be deleted by attackers.
Unauthenticated access to delete extensions.
Confirm if this locally installed tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by sending a specially crafted request to the SillyTavern application over the network. Because no authentication is needed, the attacker can target the `/api/extensions/delete` endpoint and provide a specific input that circumvents security checks. This allows the attacker to delete all user extensions.

No authentication required.
Malicious input to delete extensions.
Deletes all user extensions.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in SillyTavern's `/api/extensions/delete` endpoint could allow an unauthenticated attacker to recursively delete the entire user extensions directory. This could occur when an attacker sends a crafted POST request to the endpoint with a specific value that bypasses filename sanitization. This action would impact the integrity and availability of the SillyTavern installation by removing all installed extensions.

User extensions directory is at risk.
Exposure via unauthenticated API endpoint.
Loss of installed extensions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects SillyTavern, a locally installed user interface. Given its typical deployment as a personal tool, ownership likely resides with individual users or desktop support teams responsible for user-provided applications. The first critical step is to identify any instances of SillyTavern on the network, confirm its accessibility and business criticality, and then coordinate remediation with the accountable owner.

User or desktop support teams own the issue.
Verify affected user installations and accessibility.
Plan remediation with accountable users.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SillyTavern?

SillyTavern is a locally installed software interface that acts as a front-end for various AI models, including text generators, image engines, and voice synthesis tools. It provides a visual dashboard to manage these interactions, allowing users to customize their AI experience through various extensions.

What does CVE-2026-44650 mean?

This CVE refers to a Path Traversal vulnerability (CWE-22). It exists because the software fails to properly sanitize input when managing extensions. An attacker can exploit this flaw to escape expected file directory boundaries, ultimately causing the system to delete files it should not be able to access.

How can an attacker trigger this deletion?

The flaw is triggered by sending a specific, crafted network request to the application's API endpoint designed for deleting extensions. Simply navigating the user interface normally will not trigger this bug; it requires a deliberate request formatted specifically to bypass the application's internal filename security checks.

Is my SillyTavern instance at risk?

According to Halo Surface Signal, this software is intended for local, personal use rather than public network access. While the flaw allows unauthenticated remote requests, most users are not at high risk unless they have specifically configured their local installation to be accessible over the public internet.

Do I need to take action if I use this software?

Yes, if you use SillyTavern, you should update to version 1.18.0 or newer immediately. This update corrects the sanitization logic in the API. Before updating, verify whether you have any active instances running on your systems and ensure they are not inadvertently exposed to untrusted network traffic.

References

github.com/SillyTavern/SillyTavern/security/advisories/GHSA-886q…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.