CVE-2025-59835: high-severity vulnerability in langbot-app LangBot
LangBot has a cross-directory file upload vulnerability, which could lead to system takeover
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.4%
LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
langbot-app · LangBotRelated CVEs — langbot-app LangBot
In the same product, most dangerous first.
CVE-2026-90562CRITICALLangBot before 4.10.11 Authentication Bypass via Weak Recovery KeyEPSS 0.7%CVE-2026-54449HIGHLangBot: Authenticated RCE Via MCP ConfigurationEPSS 0.7%CVE-2026-90938HIGHLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketEPSS 0.6%CVE-2026-28509MEDIUMLangBot has a Cross Site Scripting(XSS) VulnerabilityEPSS 0.2%CVE-2026-112265HIGHLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity VerificationEPSS 0.2%