PT-2025-27355 · Unknown · Langchain-Chatchat

Published 2025-06-29 · Updated 2025-06-29 · CVE-2025-6854

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Langchain-Chatchat versions up to 0.3.1

Description: A problematic vulnerability was found in Langchain-Chatchat, affecting unknown code of the file "/v1/files?purpose=assistants". This issue leads to path traversal and can be initiated remotely. The exploit has been disclosed to the public.

Recommendations: For versions up to 0.3.1, consider restricting access to the /v1/files?purpose=assistants endpoint until a patch is available. As a temporary workaround, avoid using the purpose parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6854

GHSA-8V8H-4PJX-RG73

Affected Products

Langchain-Chatchat

References · 12

• 🔥 https://github.com/chatchat-space/Langchain-Chatchat/issues/5353 · Exploit
• https://osv.dev/vulnerability/GHSA-8v8h-4pjx-rg73 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6854 · Security Note
• https://github.com/chatchat-space/Langchain-Chatchat · Note
• https://t.me/cvetracker/27353 · Telegram Post
• https://t.me/cvenotify/127015 · Telegram Post
• https://twitter.com/CVEnew/status/1939246514272096505 · Twitter Post
• https://vuldb.com/?id.314326 · Note
• https://twitter.com/VulmonFeeds/status/1939257818223165519 · Twitter Post
• https://vuldb.com/?submit.601161 · Note
• https://vuldb.com/?ctiid.314326 · Note