PT-2025-40417 · Langbot · Langbot

Ltltlxey · CVE-2025-59835 · Published 2025-10-02 · Updated 2025-10-03

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions LangBot versions 4.1.0 through 4.3.4

Description LangBot is a global IM bot platform designed for LLMs. Authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. The interface does not strictly restrict the storage directory of files on the server, allowing the upload of dangerous files to specific system directories. The files parameter within the /api/v1/files/documents endpoint is vulnerable.

Recommendations Update to version 4.3.5 or later.

Exploit

Fix

Relative Path Traversal

Unrestricted File Upload

Weakness Enumeration

CWE-23

CWE-434

Related Identifiers

CVE-2025-59835

GHSA-7J3J-QJ83-9QV4

Affected Products

Langbot

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59835.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59835 · Security Note
• https://github.com/langbot-app/LangBot/pull/1691 · Note
• https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4 · Note
• https://github.com/langbot-app/LangBot/releases/tag/v4.3.5 · Note
• https://twitter.com/VulmonFeeds/status/1973934398178291942 · Twitter Post
• https://t.me/CVEtracker/33969 · Telegram Post
• https://twitter.com/CVEnew/status/1973831331969630537 · Twitter Post