CVE-2025-45691: RAGAS File Read Vulnerability

CVE-2025-45691 Overview

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS versions v0.2.3 through v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs. This flaw allows attackers to read arbitrary files from the server's filesystem by manipulating URL inputs that bypass expected validation controls.

Critical Impact

Attackers can exploit this vulnerability to read sensitive files from the server, potentially exposing configuration files, credentials, source code, and other confidential data stored on vulnerable RAGAS deployments.

Affected Products

• Exploding Gradients RAGAS v0.2.3
• Exploding Gradients RAGAS versions through v0.2.14
• Applications using the ImageTextPromptValue class with multimodal inputs

Discovery Timeline

• 2026-03-05 - CVE CVE-2025-45691 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2025-45691

Vulnerability Analysis

This vulnerability is categorized as an Arbitrary File Read (a form of Path Traversal/Local File Inclusion) affecting the RAGAS library's multimodal prompt handling functionality. The ImageTextPromptValue class processes user-supplied URLs through the retrieved_contexts parameter without adequate validation or sanitization.

When multimodal inputs are processed, the application fails to properly restrict the types of URLs or file paths that can be specified. This allows an attacker to craft malicious input that references local file system paths instead of legitimate remote URLs. The vulnerable code path exists in the multi_modal_prompt.py module, specifically around the context retrieval logic.

The impact of successful exploitation includes unauthorized access to sensitive files on the server, which could lead to exposure of application secrets, database credentials, API keys, or other sensitive configuration data. In environments where RAGAS is deployed as part of larger AI/ML pipelines, this could compromise the entire infrastructure.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the ImageTextPromptValue class. When processing the retrieved_contexts parameter for multimodal inputs, the code does not adequately verify that supplied URLs conform to expected remote resource patterns. The absence of proper URL scheme validation and path canonicalization allows file:// protocol handlers or relative path traversal sequences to be processed, ultimately enabling local file system access.

Attack Vector

The attack vector involves supplying crafted input to the retrieved_contexts parameter that contains file system paths or file:// URLs instead of legitimate HTTP/HTTPS resources. When the ImageTextPromptValue class processes this input as part of multimodal prompt handling, it reads the contents of the specified local file and potentially exposes that data in the application response or subsequent processing stages.

An attacker could exploit this vulnerability by:

1. Identifying an application endpoint that accepts multimodal inputs processed by RAGAS
2. Crafting a request with malicious file paths in the retrieved_contexts parameter
3. Submitting the request to trigger the vulnerable code path
4. Extracting sensitive file contents from the response or processing output

For technical details on the vulnerable code path, refer to the GitHub source code reference.

Detection Methods for CVE-2025-45691

Indicators of Compromise

• Unusual file access patterns in application logs, particularly attempts to read system files like /etc/passwd, /etc/shadow, or application configuration files
• Log entries showing file:// protocol usage in contexts where only HTTP/HTTPS URLs are expected
• Path traversal sequences (e.g., ../) appearing in retrieved_contexts parameter values
• Unexpected errors related to file permissions or non-existent paths in multimodal processing logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block file:// protocol usage and path traversal patterns in request parameters
• Monitor application logs for anomalous file read operations originating from the RAGAS multimodal processing components
• Deploy runtime application self-protection (RASP) solutions to detect and block arbitrary file read attempts
• Create custom detection rules for SIEM platforms that alert on patterns consistent with local file inclusion attempts

Monitoring Recommendations

• Enable verbose logging for the RAGAS library to capture all multimodal input processing activities
• Monitor file system access patterns from the application process to detect reads of sensitive files
• Implement alerting for any file access outside expected data directories by the RAGAS processing components
• Regularly audit application logs for suspicious URL patterns in the retrieved_contexts parameter

How to Mitigate CVE-2025-45691

Immediate Actions Required

• Upgrade RAGAS to a patched version that addresses this vulnerability (versions after v0.2.14)
• Review and restrict network access to systems running vulnerable RAGAS deployments
• Implement input validation at the application layer to reject file:// URLs and path traversal sequences before they reach RAGAS
• Conduct an audit of logs to identify any potential exploitation attempts

Patch Information

Security patches addressing this vulnerability have been developed and are available through the official RAGAS repository. The GitHub Pull Request #1559 and GitHub Pull Request #1991 contain fixes for this vulnerability. Organizations should review these patches and upgrade to the latest patched version of RAGAS.

For detailed vulnerability information, see the Adithya Nak Vulnerability Report.

Workarounds

• Implement strict URL validation at the application layer to only allow HTTP/HTTPS schemes in the retrieved_contexts parameter
• Deploy the RAGAS application in a sandboxed environment with restricted file system access
• Use containerization to limit the files accessible to the RAGAS process
• Apply network segmentation to minimize the impact of potential data exfiltration

# Example: Restrict file system access using container security context
# When deploying RAGAS in Kubernetes, apply read-only root filesystem
# and limit volume mounts to only required directories
# securityContext:
#   readOnlyRootFilesystem: true
#   allowPrivilegeEscalation: false