{"data":{"id":"c42f5f69-dea1-4a7e-85bd-6cc9ab2c1701","title":"CVE-2025-6853: A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects…","summary":"A critical path traversal vulnerability (CWE-22) has been found in chatchat-space Langchain-Chatchat up to version 0.3.1. It affects the upload_temp_docs function, reached through the /knowledge_base/upload_temp_docs endpoint of the Backend component, where manipulating the flag argument leads to path traversal. The flaw can be exploited remotely, and public exploit disclosure means it may be used.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-6853","publishedAt":"2025-06-29T12:15:21.550Z","cveId":"CVE-2025-6853","cweIds":["CWE-22"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-chatchat@<= 0.3.1.3"],"affectedPackageNames":["langchain-chatchat"],"affectedPackageRefs":["pypi:langchain-chatchat"],"affectedVendors":[],"affectedVendorsRaw":["Langchain-Chatchat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langchain-Chatchat path traversal in upload_temp_docs","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.006,"epssCheckedAt":"2026-11-04T18:09:13.116Z","kevDateAdded":null,"advisoryAliases":["GHSA-qmgv-j263-qr33"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:32.165Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}