CVE-2025-6773CWE-22

HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal

Medium · published June 27, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-06-27T19:00Z
EPSS history
Timeline
  • 27 JUN 19:00Z
    HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal
    cvelistv5