cve.bz

CVE-2025-6853

2.1 lowEPSS 0.6%

Low (2.1) in chatchat-space langchain-chatchat. EPSS 0.6% chance of exploitation in the next 30 days.

A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.1 low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qmgv-j263-qr33PyPIlangchain-chatchat<=0.3.1.3no fix published
PYSEC-2026-1513PyPIlangchain-chatchat<=0.3.1.3no fix published

References

Check your stackJSON