CVE-2025-53358CWE-22

kotaemon Vulnerable to Path Traversal via Link Upload

Medium · published July 2, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the index_fn method accepts both URLs and local file paths without validation. The pipeline streams these paths directly and stores them, enabling attackers to traverse directories (e.g. ../../../../../.env) and exfiltrate sensitive files. This issue has been patched via commit 37cdc28, in version 0.10.7 which has not been made public at time of publication.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-07-02T15:38Z
EPSS history
Timeline
  • 02 JUL 15:38Z
    kotaemon Vulnerable to Path Traversal via Link Upload
    cvelistv5