CVE-2025-6853mediumCWE-22

CVE-2025-6853: falha de média gravidade em chatchat-space Langchain-Chatchat

chatchat-space Langchain-Chatchat Backend upload_temp_docs path traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Langchain-Chatchat+ Monitorar langchain-chatchat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
chatchat-space · Langchain-Chatchat
CVEs relacionadas — chatchat-space Langchain-Chatchat

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75128CRITICALLangchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call EndpointEPSS 2.2%CVE-2025-6855MEDIUMchatchat-space Langchain-Chatchat file path traversalEPSS 0.6%CVE-2025-6854MEDIUMchatchat-space Langchain-Chatchat files path traversalEPSS 0.6%CVE-2026-7844MEDIUMchatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authenticationEPSS 0.3%CVE-2026-7847LOWchatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valuesEPSS 0.2%CVE-2026-7846LOWchatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouEPSS 0.2%