Is CVE-2025-7707 actively exploited?

No active exploitation of CVE-2025-7707 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-7707 be exploited remotely?

No. CVE-2025-7707 requires local access to exploit.

What is the CVSS score of CVE-2025-7707?

CVE-2025-7707 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2025-7707

HIGH

CVE-2025-7707

CWE-377Published: October 13, 2025· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.

NVD Source

Technical Analysis

CVE-2025-7707 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.