LlamaIndex encode_image Path Traversal

How the attack works

An attacker crafts a tool call to the agent's image-handling feature and sets image_path to a traversal sequence (../, ..\, or URL-encoded variants) or an absolute path pointing at a sensitive location instead of a normal image file. The vulnerable encode_image function does not validate this path, so it opens and reads whatever file the attacker named. The detection looks for this suspicious path value in a structured tool call, then checks whether the same session subsequently performed a file read of a sensitive file, or of the exact file named in the traversal payload, within a five-minute window. Only activity traced back to the same calling process and its session is used to confirm the pattern, so unrelated sessions are not mixed in.

Netzilo detection

Why it matters

An attacker can exfiltrate arbitrary files from the host running the agent, including credentials, configuration data, or other sensitive files reachable by the agent process.

What you can do

• →Upgrade LlamaIndex past the affected version range (0.12.27-0.12.40) or apply the vendor's fix for the encode_image path handling.
• →Validate and canonicalize any user- or model-supplied image_path before it reaches file-reading code; reject paths containing traversal sequences or resolving outside an allowed image directory.
• →Run agent processes with least-privilege file-system access so a successful traversal cannot reach sensitive files.
• →When investigating alerts, check whether the image_path was a legitimate relative path (low risk) versus a traversal sequence or absolute path into a sensitive location followed by an actual sensitive file read (high risk).

Known benign look-alikes

• Multimodal pipelines that legitimately pass relative image paths such as "../assets/diagram.png". Not reported - a relative path with no sensitive token and no corroborating sensitive read never reaches a verdict.
• Security regression tests or CVE reproduction fixtures that deliberately send image_path=../../../etc/passwd through a tool call. These will be reported as an attempt; scope them out by session/agent at triage.
• A human asking the model how to fix this CVE in free prose. Mitigated - the attempt-only verdict is restricted to structured tool-parameter contexts (tool_input/tool_output/llm_tool_call/llm_tool_result); prose contexts must also show a corroborating arbitrary-file read.
• Tool and gateway description text that documents the vulnerable parameter. Mitigated - description contexts are excluded by the relevance gate.
• An unrelated process in the same lineage reading /etc/hosts while an image is being encoded. Mitigated - the read must fall inside the 5-minute window that ends at the payload event and the payload anchor is required first.

References

• https://cwe.mitre.org/data/definitions/22.html
• https://github.com/run-llama/llama_index
• https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• https://owasp.org/Top10/A03_2021-Injection/