Medium severity · published Jun 27, 2025
CVE-2025-6773
HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LightRAG · HKUDS
1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6773
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6773
github.com
https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf
github.com
https://github.com/HKUDS/LightRAG/issues/1692
github.com
https://github.com/HKUDS/LightRAG/issues/1692#issuecomment-3009368235
vuldb.com
https://vuldb.com/?ctiid.314089
vuldb.com
https://vuldb.com/?id.314089
vuldb.com
https://vuldb.com/?submit.601276
More from LightRAG
9.8
CVE-2026-61808
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
9.3
CVE-2026-61740
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
9.3
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
9.1
CVE-2026-85734
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
7.1
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard