CVE-2025-53358: kotaemon Path Traversal Vulnerability

CVE-2025-53358 Overview

CVE-2025-53358 is a path traversal vulnerability [CWE-22] in kotaemon, an open-source Retrieval-Augmented Generation (RAG) tool for document comprehension. The flaw affects versions 0.10.6 and earlier. The index_fn method in libs/ktem/ktem/index/file/ui.py accepts both URLs and local file paths without validation. Attackers with low privileges can supply traversal sequences such as ../../../../../.env to read sensitive files outside the intended directory. The pipeline streams and stores these paths directly, enabling exfiltration of arbitrary readable files on the host. The maintainers patched the issue in commit 37cdc28, included in version 0.10.7.

Critical Impact
Authenticated attackers can traverse directories through the file indexing pipeline to read and exfiltrate sensitive files, including environment configuration containing credentials.

Affected Products

kotaemon versions 0.10.6 and prior
Component: libs/ktem/ktem/index/file/ui.py (index_fn method)
Fixed in kotaemon version 0.10.7 (commit 37cdc28)

Discovery Timeline

2025-07-02 - CVE-2025-53358 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53358

Vulnerability Analysis

kotaemon exposes a file indexing interface that ingests documents into its RAG pipeline. The index_fn method in libs/ktem/ktem/index/file/ui.py accepts user-supplied strings representing either remote URLs or local file paths. The method does not validate or normalize these inputs before passing them to the ingestion pipeline. The pipeline reads the file from the provided path and stores its contents inside the vector index. An authenticated user can submit a path containing directory traversal sequences to reach files outside the intended document directory.

Root Cause

The vulnerability stems from missing input validation on user-controlled file paths. The index_fn method treats any string as a legitimate ingestion source without canonicalizing the path or enforcing an allowlist of directories. Traversal characters such as ../ are preserved and resolved by the underlying filesystem calls. This design conflates two distinct input types (URLs and local paths) into a single unsanitized code path.

Attack Vector

An attacker with an authenticated session submits a crafted path such as ../../../../../.env through the indexing interface. kotaemon reads the target file and stores its contents in the RAG index. The attacker then retrieves the ingested content through normal query or document-listing functionality, exfiltrating credentials, API keys, or other sensitive configuration.

python

# Excerpt from the security patch in libs/ktem/ktem/index/file/ui.py
# Source: https://github.com/Cinnamon/kotaemon/commit/37cdc28ceb46e505d25221584daf1fe61e26b2cc

        """Handle zip files"""
        zip_files = [file for file in files if file.endswith(".zip")]
        remaining_files = [file for file in files if not file.endswith("zip")]
+       errors: list[str] = []

        # Clean-up <zip_dir> before unzip to remove old files
        shutil.rmtree(zip_dir, ignore_errors=True)

+       # Unzip
        for zip_file in zip_files:
            # Prepare new zip output dir, separated for each files
            basename = os.path.splitext(os.path.basename(zip_file))[0]
            zip_out_dir = os.path.join(zip_dir, basename)
            os.makedirs(zip_out_dir, exist_ok=True)
+
            with zipfile.ZipFile(zip_file, "r") as zip_ref:
                zip_ref.extractall(zip_out_dir)

The patch introduces validation and error collection around file handling. See the GitHub Security Advisory GHSA-jw4w-xcvf-jq5x and Pull Request #755 for the complete fix.

Detection Methods for CVE-2025-53358

Indicators of Compromise

Application logs recording ingestion requests containing ../ or absolute paths pointing outside the configured document directory.
RAG index entries whose stored source paths reference system files such as .env, /etc/passwd, id_rsa, or cloud credential files.
Unexpected read access on sensitive configuration files by the kotaemon service account.

Detection Strategies

Inspect kotaemon request logs for path parameters containing traversal sequences, URL-encoded variants (%2e%2e%2f), or absolute filesystem paths.
Audit the vector index metadata for stored document sources that do not match expected upload locations.
Correlate authenticated kotaemon sessions with filesystem access telemetry from the host to identify reads outside the document root.

Monitoring Recommendations

Enable filesystem auditing on directories containing secrets, configuration files, and user home directories on hosts running kotaemon.
Forward kotaemon application logs to a centralized log platform and alert on traversal patterns in ingestion endpoints.
Monitor outbound traffic from the kotaemon host for unusual data volumes that may indicate exfiltration of ingested sensitive content.

How to Mitigate CVE-2025-53358

Immediate Actions Required

Upgrade kotaemon to version 0.10.7 or later, which contains commit 37cdc28.
Rotate any credentials, API keys, or tokens stored in files readable by the kotaemon service account, particularly .env files.
Review the RAG index for entries sourced from paths outside the intended document directory and purge unauthorized content.
Restrict access to the kotaemon interface to trusted authenticated users only until the upgrade is applied.

Patch Information

The fix is delivered in kotaemon version 0.10.7 via commit 37cdc28, which adds validation to libs/ktem/ktem/index/file/ui.py to prevent path-traversal input from reaching the ingestion pipeline. Reference: GitHub Commit 37cdc28 and Pull Request #755.

Workarounds

Run kotaemon under a dedicated low-privilege service account with filesystem access restricted to the document ingestion directory.
Deploy kotaemon inside a container or chroot with read-only bind mounts limited to the intended document paths.
Place a reverse proxy in front of kotaemon that rejects requests containing ../, ..\, or URL-encoded traversal sequences in ingestion parameters.

bash

# Upgrade kotaemon to the patched version
pip install --upgrade "kotaemon>=0.10.7"

# Verify installed version
pip show kotaemon | grep -i version