TI-2025-06152 Aliases CVE-2025-6773 GHSA-v9w6-9hq9-33ch

HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal

MEDIUM 55CWE-22Published 2025-06-27 · Updated 2025-06-27

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00211 11th percentileScored 2026-11-07

Fix Fixed lightrag-hku (PyPI): 1.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HKUDS	LightRAG	1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8	—	No fix listed	CNA
—	lightrag-hku (PyPI)	before 1.3.8	1.3.8	Patch available	GHSA-v9w6-9hq9-33ch

LightRAG VendorHKUDS Affected 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; 1.3.6; 1.3.7; 1.3.8 Fixed in — No fix listed CNA
lightrag-hku (PyPI) Vendor— Affected before 1.3.8 Fixed in 1.3.8 Patch available GHSA-v9w6-9hq9-33ch

Remediation

Fix · GHSA-v9w6-9hq9-33ch lightrag-hku (PyPI) Fixed in 1.3.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-6773
2026-10-03 Alias added: GHSA-v9w6-9hq9-33ch

References

Patch 1

https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-6773

Other 3

TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences