Log in Start free

Vulnerability · Published Jun 27, 2025 · Assigned by VulDB

CVE-2025-6773HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal

Medium 5.3

In plain English

A medium-severity path traversal in LightRAG from HKUDS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 88.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlightrag-hku1.3.8GHSA-v9w6-9hq9-33ch
PyPIlightrag-hku1.3.8PYSEC-2026-1539

Affected products (as reported)

VendorProductVersions
HKUDS LightRAG 1.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References