CVE-2025-6854: Langchain-Chatchat Path Traversal Vulnerability

CVE-2025-6854 Overview

CVE-2025-6854 is a path traversal vulnerability [CWE-22] affecting chatchat-space/Langchain-Chatchat versions up to and including 0.3.1. The flaw resides in the file upload handler at /v1/files?purpose=assistants, where insufficient input validation allows an authenticated remote attacker to manipulate file paths and access or write files outside the intended directory. The exploit has been publicly disclosed. Langchain-Chatchat is an open-source retrieval-augmented generation (RAG) application built on the LangChain framework, commonly deployed for local knowledge-base chatbots.

Critical Impact
A remote attacker with low privileges can traverse the file system through the assistants file upload endpoint, potentially reading or overwriting files outside the intended upload directory.

Affected Products

chatchat-space Langchain-Chatchat versions up to and including 0.3.1
Deployments exposing the /v1/files API endpoint
Self-hosted RAG applications built on vulnerable Langchain-Chatchat releases

Discovery Timeline

2025-06-29 - CVE-2025-6854 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6854

Vulnerability Analysis

The vulnerability affects the file upload handler exposed at /v1/files?purpose=assistants. The endpoint accepts a filename or path parameter without properly normalizing or validating directory separators and relative path sequences such as ../. An authenticated attacker can craft a request that references locations outside the intended upload directory, causing the server to read or write files at arbitrary locations accessible to the application process.

Because the endpoint is network-reachable and requires only low privileges, exploitation can be performed remotely against any exposed instance. Path traversal in file upload flows commonly leads to overwriting configuration files, dropping executable payloads into web-served directories, or exfiltrating local secrets. Full technical discussion is available in the Langchain-Chatchat GitHub issue #5353 and the VulDB entry #314326.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The upload handler concatenates attacker-supplied filename input into a filesystem path without canonicalizing the result or verifying it remains within the designated uploads directory.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An authenticated client issues a crafted POST request to /v1/files?purpose=assistants containing traversal sequences in the filename field. The server resolves the path relative to the upload root, allowing the write or read operation to escape the intended boundary. No verified exploit code is currently published in the referenced sources; refer to the vendor issue tracker for technical details.

Detection Methods for CVE-2025-6854

Indicators of Compromise

Requests to /v1/files?purpose=assistants containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute filesystem paths in the filename parameter
Unexpected files appearing outside the configured Langchain-Chatchat uploads directory
Modifications to application configuration files, startup scripts, or Python modules with timestamps aligned to upload activity
Anomalous read access to sensitive files such as .env, config.py, or SSH keys from the Langchain-Chatchat service account

Detection Strategies

Inspect web server and application logs for POST requests to /v1/files containing path traversal patterns in query strings or multipart form data
Deploy a web application firewall rule to flag traversal metacharacters in upload requests to the assistants endpoint
Correlate file creation events on the Langchain-Chatchat host with corresponding HTTP requests to identify writes outside the uploads directory

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting Langchain-Chatchat and retain filename parameters for review
Monitor filesystem integrity on directories adjacent to the uploads path, including application source and configuration directories
Alert on authentication events for the Langchain-Chatchat API followed by rapid sequential file upload requests

How to Mitigate CVE-2025-6854

Immediate Actions Required

Restrict network access to the Langchain-Chatchat API using firewall rules or a reverse proxy that limits exposure to trusted clients
Audit the uploads directory and surrounding filesystem for unexpected files or modifications matching the disclosure window
Rotate any credentials, API keys, or tokens stored in files reachable from the Langchain-Chatchat service account

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for versions after 0.3.1. Monitor the Langchain-Chatchat GitHub repository for a patched release and apply it once available. Track the upstream issue tracker for maintainer guidance on affected code paths.

Workarounds

Place Langchain-Chatchat behind a reverse proxy that rejects requests to /v1/files containing .., backslashes, or encoded traversal sequences
Run the application as a low-privilege user with filesystem permissions scoped strictly to the uploads directory
Require strong authentication on the API and disable the assistants upload endpoint if it is not required for the deployment
Containerize the deployment with a read-only root filesystem and a dedicated writable volume mounted only at the uploads path

bash

# Example nginx snippet to block traversal patterns targeting the vulnerable endpoint
location /v1/files {
    if ($args ~* "\.\.|%2e%2e|%2f%2e\.") { return 403; }
    if ($request_body ~* "\.\./|\.\.\\\\") { return 403; }
    proxy_pass http://langchain_chatchat_upstream;
}