CVE-2025-6773 Details
Description
A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.
A critical path traversal vulnerability has been identified in HKUDS LightRAG versions through 1.3.8. The issue arises in the file upload function 'upload_to_input_dir' within 'lightrag/api/routers/document_routes.py'. The vulnerability allows attackers to manipulate the 'file.filename' argument to traverse directories, potentially uploading malicious files to unintended locations on the server.
Users are advised to update to LightRAG version 1.3.9 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 27, 2025CISA-ADP
Assessed Jun 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/issues/1692 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/HKUDS/LightRAG/issues/1692#issuecomment-3009368235 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/?ctiid.314089 | [email protected] | AdvisoryRemedy |
| https://vuldb.com/?id.314089 | [email protected] | AdvisoryRemedy |
| https://vuldb.com/?submit.601276 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HKUDS LightRAG | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 27, 2025 | New CVE Received | [email protected] |