EUVD-2026-40006
GHSA-284m-435q-x4gm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires low-privilege authentication; path traversal yields limited read, write, and delete access, no scope change beyond the application process.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Path traversal in RAGapp's Knowledge File Handler (versions up to 0.1.5) allows authenticated low-privilege users to read, write, or delete files outside the intended data/ directory by supplying crafted filenames containing sequences such as '../' to the upload or remove file API endpoints. The vulnerability exists in the FileHandler.upload_file and FileHandler.remove_file functions in src/ragapp/backend/controllers/files.py, where client-supplied filenames were interpolated directly into file paths without sanitization. A proof-of-concept exploit has been publicly disclosed; however, no vendor-released patched version is available as of analysis date - only an unmerged upstream pull request (PR #294) addresses the issue.
Technical ContextAI
RAGapp is a Python-based open-source framework for building Retrieval-Augmented Generation (RAG) applications. The vulnerable component is the Knowledge File Handler controller at src/ragapp/backend/controllers/files.py, which manages user-supplied knowledge base documents. Root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Specifically, filenames provided by API clients were concatenated directly into file system paths using f-string interpolation (e.g., f'data/{file_name}') with no validation against traversal sequences, null bytes, absolute paths, or nested path components. The PR #294 fix introduces a dedicated get_data_file_path() method using Python's pathlib.Path.resolve() to canonicalize and then verify that the resolved path's parent matches the intended DATA_DIR - a standard defense-in-depth pattern. Both upload (write) and remove (delete) operations were affected. The management router at src/ragapp/backend/routers/management/files.py passes the raw filename from the HTTP multipart upload or DELETE request directly into these functions.
RemediationAI
No vendor-released patched version is available at time of analysis - the fix exists only as unmerged PR #294 at https://github.com/ragapp/ragapp/pull/294, which awaits acceptance. Organizations should monitor that PR and apply the patch manually by cherry-picking or patching the files.py controller directly, implementing the get_data_file_path() validation logic shown in the PR diff. As an immediate compensating control, restrict access to the file management API endpoints to trusted internal networks or privileged users only using a reverse proxy or network ACL - this reduces the PR:L attack surface by ensuring only explicitly authorized users can reach the endpoint. Additionally, run the RAGapp process under a dedicated OS account with filesystem permissions scoped strictly to the data/ directory and application files, so that even a successful traversal cannot access sensitive host files. Monitor file system activity in the application working directory for anomalous access patterns outside data/. Trade-off: restricting network access to the management API may impact legitimate multi-user workflows.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today