CVE-2025-6773 | THREATINT

Description

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.

In HKUDS LightRAG bis 1.3.8 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es die Funktion upload_to_input_dir der Datei lightrag/api/routers/document_routes.py der Komponente File Upload. Mittels Manipulieren des Arguments file.filename mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff muss lokal angegangen werden. Der Patch wird als 60777d535b719631680bcf5d0969bdef79ca4eaf bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.

Reserved 2025-06-27 | Published 2025-06-27 | Updated 2025-06-27 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

MEDIUM: 5.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

4.3AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C

Problem types

Path Traversal

Product status

1.3.0

affected

1.3.1

affected

1.3.2

affected

1.3.3

affected

1.3.4

affected

1.3.5

affected

1.3.6

affected

1.3.7

affected

1.3.8

affected

Timeline

2025-06-27:	Advisory disclosed
2025-06-27:	VulDB entry created
2025-06-27:	VulDB entry last update

Credits

Hannibal0x (VulDB User) reporter

References

vuldb.com/?id.314089 (VDB-314089 | HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal) vdb-entry technical-description

vuldb.com/?ctiid.314089 (VDB-314089 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.601276 (Submit #601276 | HKUDS LightRAG v1.3.8 Path Traversal) third-party-advisory

github.com/HKUDS/LightRAG/issues/1692 issue-tracking

github.com/...ommit/60777d535b719631680bcf5d0969bdef79ca4eaf patch

cve.org (CVE-2025-6773)

nvd.nist.gov (CVE-2025-6773)

Download JSON