CVE-2025-27519: Cognita Framework RCE Vulnerability

CVE-2025-27519 Overview

CVE-2025-27519 is a critical path traversal vulnerability in Cognita, a RAG (Retrieval Augmented Generation) Framework developed by TrueFoundry for building modular, open source applications for production. The vulnerability exists in the /v1/internal/upload-to-local-directory endpoint and is exploitable when the Local environment variable is set to true, such as in default Docker deployments.

Due to the Docker environment configuring the backend uvicorn server with auto-reload enabled, an attacker exploiting this path traversal vulnerability can overwrite the /app/backend/__init__.py file. Once overwritten, the file is automatically reloaded and executed, allowing unauthenticated remote code execution within the context of the Docker container.

Critical Impact

Unauthenticated attackers can achieve remote code execution by exploiting a path traversal vulnerability to overwrite Python files that are automatically reloaded by the uvicorn server in Docker deployments.

Affected Products

• TrueFoundry Cognita (versions prior to commit a78bd065e05a1b30a53a3386cc02e08c317d2243)
• Cognita Docker deployments with Local environment variable set to true
• Cognita instances running uvicorn with auto-reload enabled

Discovery Timeline

• 2025-03-07 - CVE-2025-27519 published to NVD
• 2025-03-07 - Last updated in NVD database

Technical Details for CVE-2025-27519

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) enables attackers to escape the intended upload directory through path traversal sequences. The /v1/internal/upload-to-local-directory endpoint fails to properly sanitize user-supplied file paths, allowing directory traversal characters (such as ../) to be used to write files outside the designated upload location.

The exploitation chain is particularly severe because Docker deployments of Cognita configure uvicorn with the --reload flag enabled. This means that when core Python files like /app/backend/__init__.py are modified, the server automatically detects the change and reloads the module, executing any malicious code injected by the attacker.

Root Cause

The root cause is improper input validation on the file upload endpoint. The application accepts user-controlled path components without sanitizing or validating them against path traversal sequences. Combined with the auto-reload functionality of the uvicorn server in development/Docker configurations, this transforms a file write vulnerability into remote code execution.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP request to the /v1/internal/upload-to-local-directory endpoint containing path traversal sequences in the filename or path parameter. By targeting the /app/backend/__init__.py file, the attacker can inject arbitrary Python code that will be automatically executed when uvicorn detects the file change and reloads the module.

The attack flow involves sending a crafted upload request with a path containing directory traversal sequences (e.g., ../../backend/__init__.py) along with malicious Python code as the file content. Once the file is written, the uvicorn auto-reload mechanism executes the injected code within the Docker container context.

Detection Methods for CVE-2025-27519

Indicators of Compromise

• Unexpected modifications to /app/backend/__init__.py or other Python files in the application directory
• HTTP requests to /v1/internal/upload-to-local-directory containing path traversal sequences (../, ..%2F, ..%252F)
• Unusual file write operations outside the designated upload directory
• Uvicorn reload events triggered by unexpected file modifications

Detection Strategies

• Monitor web server access logs for requests to /v1/internal/upload-to-local-directory containing encoded or plain path traversal characters
• Implement file integrity monitoring on critical Python files within the Cognita application directory
• Deploy web application firewall (WAF) rules to detect and block path traversal attempts in upload requests
• Enable audit logging for file system operations within the Docker container

Monitoring Recommendations

• Configure alerts for any file modifications in the /app/backend/ directory structure
• Monitor for uvicorn reload events that are not triggered by legitimate deployments or updates
• Review Docker container logs for unexpected Python execution or import errors indicating code injection attempts
• Implement network traffic analysis to detect anomalous upload patterns to internal endpoints

How to Mitigate CVE-2025-27519

Immediate Actions Required

• Update Cognita to a version containing commit a78bd065e05a1b30a53a3386cc02e08c317d2243 or later
• If unable to update immediately, disable the /v1/internal/upload-to-local-directory endpoint or restrict access to trusted networks only
• Set the Local environment variable to false if local file uploads are not required
• Disable uvicorn auto-reload in production environments

Patch Information

TrueFoundry has addressed this vulnerability in commit a78bd065e05a1b30a53a3386cc02e08c317d2243. The fix is available through GitHub Pull Request 393. Organizations running Cognita should update to a version containing this commit immediately.

For additional details on the vulnerability, refer to the GitHub Security Advisory GHSL-2024-193/194 and the patch commit.

Workarounds

• Implement network-level access controls to restrict access to the /v1/internal/upload-to-local-directory endpoint to trusted internal networks only
• Deploy a reverse proxy or WAF with path traversal detection rules in front of the Cognita application
• Run Cognita with uvicorn auto-reload disabled by removing the --reload flag from the server startup command
• Set the Local environment variable to false to disable local directory uploads entirely if this functionality is not required

# Disable auto-reload in uvicorn startup (production configuration)
uvicorn app.backend.main:app --host 0.0.0.0 --port 8000 --workers 4
# Note: Remove --reload flag to prevent automatic code execution on file changes

# Alternatively, set environment variable to disable local uploads
export LOCAL=false