CVE-2025-6773 MEDIUM

CVE-2025-6773: HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal

Vendor Hkuds
Product LightRAG
Weakness CWE-22 · Path traversal
Published June 27, 2025
Last update June 27, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.

Key dates

02Disclosure timeline

June 27, 2025 CVE published
June 27, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-24965 .krun_config.json symlink attack creates or overwrites file on the host in crun CVE-2026-39407 Hono has a middleware bypass via repeated slashes in serveStatic CVE-2025-47273 setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write CVE-2025-13725 Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter CVE-2026-6636 p2r3 convert API buildCache.js Bun.serve path traversal