PT-2026-53165 · Undefined · Undefined

Published 2026-06-28 · Updated 2026-06-28 · CVE-2026-13509

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload file/FileHandler.remove file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-13509

Affected Products

Undefined

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-13509 · Security Note
• https://github.com/ragapp/ragapp/pull/294 · Note
• https://github.com/ragapp/ragapp/issues/293 · Note
• https://vuldb.com/cve/CVE-2026-13509 · Note
• https://vuldb.com/vuln/374517/cti · Note
• https://github.com/ragapp/ragapp · Note
• https://vuldb.com/submit/838838 · Note
• https://vuldb.com/vuln/374517 · Note