CVE-2025-6855: Langchain-Chatchat Path Traversal Flaw

CVE-2025-6855 Overview

CVE-2025-6855 is a path traversal vulnerability in chatchat-space Langchain-Chatchat through version 0.3.1. The flaw resides in unknown processing logic of the /v1/file endpoint, where manipulation of the flag argument enables directory traversal [CWE-22]. An authenticated attacker on an adjacent network can supply crafted path segments to access files outside the intended directory. The exploit details have been disclosed publicly through VulDB, increasing the risk of opportunistic abuse against exposed instances.

Critical Impact
Authenticated adjacent-network attackers can traverse the file system through the /v1/file endpoint and read or interact with files outside the application's intended scope.

Affected Products

chatchat-space Langchain-Chatchat versions up to and including 0.3.1
Deployments exposing the /v1/file HTTP endpoint
Self-hosted Langchain-Chatchat instances reachable from adjacent networks

Discovery Timeline

2025-06-29 - CVE-2025-6855 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6855

Vulnerability Analysis

The vulnerability affects the /v1/file route in Langchain-Chatchat, a retrieval-augmented generation application built on the LangChain framework. The endpoint accepts a flag argument that is incorporated into a file system operation without adequate sanitization. Attackers can submit traversal sequences such as ../ within the argument to escape the application's working directory.

The attack requires low privileges and operates over an adjacent network according to the published CVSS 4.0 vector. Successful exploitation yields limited impact to confidentiality, integrity, and availability, consistent with file read or write outside intended directories. The flaw is categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is missing or insufficient validation of user-supplied input used to construct file paths. The flag parameter is passed to file handling logic without canonicalization or allowlist enforcement, allowing relative path components to alter the resolved location on disk.

Attack Vector

An attacker with low-privileged access to the application sends a crafted HTTP request to /v1/file containing traversal sequences in the flag parameter. Because the endpoint resolves the path against the server's file system, the request can reference files in parent directories. No user interaction is required, and the exploit has been disclosed publicly through VulDB entry 314327 and the GitHub issue tracker.

No verified proof-of-concept code is published in the referenced sources. Refer to the vendor issue discussion for further technical context.

Detection Methods for CVE-2025-6855

Indicators of Compromise

HTTP requests to /v1/file containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f in the flag parameter
Access log entries showing successful responses from /v1/file referencing files outside the configured upload or knowledge base directory
Application logs recording file reads against system paths such as /etc/passwd, /proc/self/environ, or Windows equivalents

Detection Strategies

Inspect web access logs for anomalous values in the flag query parameter to the /v1/file endpoint
Deploy web application firewall rules that flag traversal patterns in request parameters targeting Langchain-Chatchat routes
Correlate process-level file open events on the Langchain-Chatchat host with HTTP request timestamps to identify out-of-scope file access

Monitoring Recommendations

Forward Langchain-Chatchat application and reverse proxy logs to a centralized log platform for retention and search
Alert on repeated 200 responses from /v1/file against varying paths from a single low-privilege session
Monitor for newly created or modified files in directories the application should not write to

How to Mitigate CVE-2025-6855

Immediate Actions Required

Restrict network exposure of Langchain-Chatchat so that the /v1/file endpoint is not reachable from untrusted adjacent networks
Audit existing accounts and revoke unnecessary low-privilege access until a patched build is deployed
Review historical access logs for the /v1/file endpoint to identify prior exploitation attempts

Patch Information

At the time of this writing, the vendor advisory is tracked in the Langchain-Chatchat GitHub issue #5354. Operators should monitor the project's release notes and upgrade to a version later than 0.3.1 once a fix is published. Additional vulnerability context is available at VulDB #314327.

Workarounds

Place Langchain-Chatchat behind a reverse proxy that strips or rejects requests containing path traversal sequences in query parameters
Run the application as an unprivileged user inside a container or chroot to limit the scope of accessible files
Apply allowlist validation at an upstream gateway for the flag parameter, accepting only expected identifier values

bash

# Example NGINX rule to block traversal sequences targeting /v1/file
location /v1/file {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://langchain_chatchat_upstream;
}