CVE-2025-6854

CVE-2025-6854 affects the Langchain-Chatchat package (up to version 0.3.1). The vulnerability is a path traversal in the endpoint “/v1/files?purpose=assistants” (network attack vector, low privileges, no user interaction). The root cause is improper handling/manipulation of the file path, allowin...

CVE-2025-6854 chatchat-space Langchain-Chatchat files path traversal

A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1. This vulnerability affects unknown code of the file /v1/files?purpose=assistants. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to...

CVE-2025-6853 chatchat-space Langchain-Chatchat Backend upload_temp_docs path traversal

A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function uploadtempdocs of the file /knowledgebase/uploadtempdocs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to...