Path Traversal Vulnerability in Langchain-Chatchat Affects chatchat-space
CVE-2025-6855

5.1MEDIUM

Key Information:

Vendor: Chatchat-space
Status: Langchain-chatchat
Vendor: CVE Published:; 29 June 2025

🔔 Create Chatchat-space Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-6855?

A path traversal vulnerability has been identified in the Langchain-Chatchat product from chatchat-space. This issue arises from improper processing of file input at the endpoint /v1/file, where manipulation of the argument flag can allow unauthorized file access beyond the intended directory. Due to the public disclosure of this vulnerability, it poses a significant risk, enabling potential exploitation by malicious users seeking to gain unauthorized access to sensitive files on the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Langchain-Chatchat 0.3.0

Langchain-Chatchat 0.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-6855 - Proof of Concept

chainwalk
Created by Spirizeon