Search/CVE-2025-3044
● CVE — Medium

CVE-2025-3044

VendorllamaindexProductllamaindexDiscoveredJul 7, 2025UpdatedJul 30, 2025

A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in version 0.12.28.

CVSS v3.1
5.3 MEDIUM
EPSS
0.32%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 0.04pp
0.28% → 0.32% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityLOW
AvailabilityNONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Connections
2 relationships
Timeline
disclosure → media coverage
Jul 7, 2025
Disclosure — published as a CVE record. · last revised by NVD Jul 30, 2025