Advisoriesby IbisLightRAGGHSA-v9w6-9hq9-33ch
HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
Fix: upgrade to 1.3.8 or later
A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| lightrag-hku PyPI | < 1.3.8 | 1.3.8 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2025-6773, PYSEC-2026-1539
- nvd.nist.gov/vuln/detail/CVE-2025-6773
- github.com/HKUDS/LightRAG/issues/1692
- github.com/HKUDS/LightRAG/issues/1692#issuecomment-3009368235
- github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf
- github.com/HKUDS/LightRAG
- vuldb.com/?ctiid.314089
- vuldb.com/?id.314089
- vuldb.com/?submit.601276
More LightRAG advisories
All LightRAG
lightrag-hku: Plaintext Passwords Compared Without Constant-Time FunctionCVE-2026-85725fixed in 1.5.5lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesCVE-2026-85709fixed in 1.5.5LightRAG: improper authenticationCVE-2026-61740fixed in 1.5.4LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsCVE-2026-61736fixed in 1.5.4lightrag-hku: JWT Algorithm Confusion VulnerabilityCVE-2026-39413fixed in 1.4.14LightRAG: Hardcoded JWT Signing Secret Allows Authentication BypassCVE-2026-30762fixed in 1.4.13