CVE-2025-6855: Langchain-Chatchat Path Traversal Vulnerability
Summary
CVE-2025-6855: Langchain-Chatchat vulnerable to path traversal. Affects langchain-chatchat versions < 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langchain-Chatchat is an open-source package designed for chat applications, enabling developers to integrate chat functionalities into their projects seamlessly. It offers features such as message handling, user interaction, and file processing. However, versions up to 0.3.1 are vulnerable to a critical path traversal issue, which can be exploited to access unauthorized files on the server.
Vulnerability Detail
A critical vulnerability has been identified in Langchain-Chatchat versions up to 0.3.1, specifically affecting the file processing endpoint at /v1/file. The vulnerability arises from improper handling of input parameters, allowing attackers to manipulate the argument flag and perform path traversal attacks. This could lead to unauthorized access to sensitive files on the server, potentially compromising the integrity and confidentiality of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize the argument flag used in the file processing function. This can help mitigate the risk of path traversal until an official patch is applied. For example, you can restrict the input to a predefined set of allowed paths.
Conclusion
The Langchain-Chatchat package is vulnerable to a critical path traversal issue in versions up to 0.3.1. It is essential to update to the latest version to mitigate this risk. Implementing input validation can serve as a temporary workaround while awaiting the official patch. Regular monitoring of dependencies is crucial for maintaining application security.
See every vulnerability recorded for langchain-chatchat →
FAQ
Path traversal is a security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could allow attackers to access sensitive files, leading to data breaches and compromising the security of the application.
Yes, the CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
You can use tools like Vulert, which monitors your Pipfile.lock for open-source vulnerabilities in real-time and alerts you accordingly.
Related vulnerabilities
Recent vulnerabilities recorded for langchain-chatchat.
