CVE-2025-6278: Upsonic Path Traversal Vulnerability in Versions up to 0.55.6
Summary
CVE-2025-6278: A vulnerability classified as critical was found in Upsonic up to 0.55.6. Affects upsonic versions < 0.56.0. Fixed in 0.56.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Upsonic is an open-source Python package designed for managing and serving markdown files through a web server. It allows users to easily create and share markdown content. However, certain versions of Upsonic, specifically up to 0.55.6, contain a critical vulnerability that can be exploited to perform path traversal attacks, potentially compromising the security of the server and its files.
Vulnerability Detail
A critical vulnerability has been identified in Upsonic versions up to 0.55.6, specifically in the function os.path.join located in markdown/server.py. The vulnerability arises from improper handling of the argument file.filename, which allows an attacker to manipulate file paths and access unauthorized files on the server. This could lead to severe consequences, including exposure of sensitive information and unauthorized file access.
How To Fix
Minimum fixed version
0.56.0
This is the first release that contains the fix.
pip install --upgrade "upsonic==0.56.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the file.filename argument to prevent path traversal. Ensure that the input does not contain any directory traversal characters such as '../'.
Conclusion
The vulnerability CVE-2025-6278 in Upsonic poses a significant risk to users of versions up to 0.55.6 due to its potential for path traversal attacks. It is crucial to update to version 0.56.0 or later to secure your application. Additionally, consider using Vulert for real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for upsonic →
FAQ
CVE-2025-6278 is a critical vulnerability in the Upsonic package that allows for path traversal attacks, potentially exposing sensitive files.
Versions of Upsonic up to 0.55.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If you cannot update the package immediately, implement input validation on file paths as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for upsonic.
