What is the CVSS score of CVE-2025-6773?

CVE-2025-6773 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of HKUDS LightRAG are affected by CVE-2025-6773?

Organizations using HKUDS LightRAG should be aware of moderate risk from CVE-2025-6773, a path traversal vulnerability rated CVSS 5.3. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2025-6773?

Within 30 days: Identify affected systems running HKUDS LightRAG and apply vendor patches as part of regular patch cycle. Review file handling controls.

HKUDS LightRAG CVE-2025-6773

EUVD-2025-19421 MEDIUM

Path Traversal (CWE-22)

2025-06-27 cna@vuldb.com

GHSA-v9w6-9hq9-33ch

File Upload Path Traversal

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19421

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 19:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.