Critical severity · published Jun 29, 2025
CVE-2025-6853
chatchat-space Langchain-Chatchat Backend upload_temp_docs path traversal
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
Langchain-Chatchat · chatchat-space
0.3.0; 0.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6853
Exploit
https://github.com/chatchat-space/Langchain-Chatchat/issues/5352
Permissions Required
https://vuldb.com/?ctiid.314325
Third Party Advisory
https://vuldb.com/?id.314325
Third Party Advisory
https://vuldb.com/?submit.601155
More from Langchain-Chatchat
9.8
CVE-2026-75128
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
8.8
CVE-2025-6855
chatchat-space Langchain-Chatchat file path traversal
6.3
CVE-2026-7844
chatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authentication
4.3
CVE-2025-6854
chatchat-space Langchain-Chatchat files path traversal
2.6
CVE-2026-7847
chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values