EUVD-2025-19477
GHSA-qmgv-j263-qr33
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Path traversal in Langchain-Chatchat's backend file upload endpoint allows remote attackers to manipulate file paths via the 'flag' parameter, potentially reading or writing files outside the intended directory. Versions up to 0.3.1 are affected, and a publicly available exploit exists. No active exploitation has been reported through CISA KEV, and EPSS indicates low exploitation probability (0.18%).
More in Langchain Chatchat
View allPath traversal in Langchain-Chatchat version 0.3.1 and earlier allows authenticated low-privilege users to read arbitrar
Missing authentication in Langchain-Chatchat up to version 0.3.1.3 allows unauthenticated local network attackers to acc
Path traversal vulnerability in Langchain-Chatchat up to 0.3.1 allows authenticated attackers with low privileges to rea
Insufficiently random file ID generation in Langchain-Chatchat up to version 0.3.1.3 allows authenticated local network
Time-of-check time-of-use (TOCTOU) vulnerability in Langchain-Chatchat up to 0.3.1.3 allows authenticated local network
Weak hash function in the Vision Chat Paste Image Handler of Langchain-Chatchat up to 0.3.1.3 allows local network attac
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today