# LlamaIndex encode_image Path Traversal

- **Severity:** High
- **Signature ID:** `b7f3c1d2-9a4e-4c68-8f2b-1d6e5a0c7b93`

## Summary

A bug in specific LlamaIndex versions (0.12.27-0.12.40) fails to sanitize the image_path parameter passed to its image-encoding function. An attacker who can control that parameter through a tool call can make the AI agent read files outside the intended image directory, such as system credentials or configuration files.

## How the attack works

An attacker crafts a tool call to the agent's image-handling feature and sets image_path to a traversal sequence (../, ..\, or URL-encoded variants) or an absolute path pointing at a sensitive location instead of a normal image file. The vulnerable encode_image function does not validate this path, so it opens and reads whatever file the attacker named. The detection looks for this suspicious path value in a structured tool call, then checks whether the same session subsequently performed a file read of a sensitive file, or of the exact file named in the traversal payload, within a five-minute window. Only activity traced back to the same calling process and its session is used to confirm the pattern, so unrelated sessions are not mixed in.

## Why it matters

An attacker can exfiltrate arbitrary files from the host running the agent, including credentials, configuration data, or other sensitive files reachable by the agent process.

## What you can do

- Upgrade LlamaIndex past the affected version range (0.12.27-0.12.40) or apply the vendor's fix for the encode_image path handling.
- Validate and canonicalize any user- or model-supplied image_path before it reaches file-reading code; reject paths containing traversal sequences or resolving outside an allowed image directory.
- Run agent processes with least-privilege file-system access so a successful traversal cannot reach sensitive files.
- When investigating alerts, check whether the image_path was a legitimate relative path (low risk) versus a traversal sequence or absolute path into a sensitive location followed by an actual sensitive file read (high risk).

## Known benign look-alikes

- Multimodal pipelines that legitimately pass relative image paths such as "../assets/diagram.png". Not reported - a relative path with no sensitive token and no corroborating sensitive read never reaches a verdict.
- Security regression tests or CVE reproduction fixtures that deliberately send image_path=../../../etc/passwd through a tool call. These will be reported as an attempt; scope them out by session/agent at triage.
- A human asking the model how to fix this CVE in free prose. Mitigated - the attempt-only verdict is restricted to structured tool-parameter contexts (tool_input/tool_output/llm_tool_call/llm_tool_result); prose contexts must also show a corroborating arbitrary-file read.
- Tool and gateway description text that documents the vulnerable parameter. Mitigated - description contexts are excluded by the relevance gate.
- An unrelated process in the same lineage reading /etc/hosts while an image is being encoded. Mitigated - the read must fall inside the 5-minute window that ends at the payload event and the payload anchor is required first.

## References

- https://cwe.mitre.org/data/definitions/22.html
- https://github.com/run-llama/llama_index
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
- https://owasp.org/Top10/A03_2021-Injection/

---
Source: https://www.netzilo.com/threats/llamaindex-encode-image-traversal