https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-34526.htmlhttps://patchthecve.com/cve/CVE-2026-34526.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 5.0: SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, in src/endpoints/search.js, the hostname is checked against /^\d+\.\d+\.\d+\.\d+$/. This onlhttps://patchthecve.com/cve/CVE-2026-34524.htmlhttps://patchthecve.com/cve/CVE-2026-34524.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 8.3: SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read anhttps://patchthecve.com/cve/CVE-2026-34523.htmlhttps://patchthecve.com/cve/CVE-2026-34523.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 5.3: SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticated uhttps://patchthecve.com/cve/CVE-2026-34522.htmlhttps://patchthecve.com/cve/CVE-2026-34522.htmlFri, 24 Jul 2026 21:10:00 +0000HIGH 8.1: SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to writ