CVE-2025-6278 is a medium severity (CVSS 5.5) path traversal (CWE-22) in Upsonic up to 0.55.6. It affects the function os.path.join in markdown/server.py, where the file.filename value can be used to reach files outside the intended folder. No confirmed fixed version is on record, so treat every copy as exposed until the code is fixed.
What's affected
The record says versions up to 0.55.6 are affected and does not name a fixed version. I found no fixed release in the sources I fetched.
The record describes the weakness as a path traversal through the file.filename. The CVSS vector uses an adjacent network (AV:A), so it points to a user who is on the same local network segment, with low privileges. That is lower than a plain internet attack, and it explains the medium score. The record says the exploit has been disclosed publicly and may be used.
How to check if you're exposed
Upsonic is open source. Check which version you run, and whether it is one of the affected builds:
pip show upsonic
pip list 2>/dev/null | grep -i upsonic
If you run from a Git checkout, note the commit instead:
git rev-parse HEAD
Then read the code at the function os.path.join in markdown/server.py and see how the file.filename value is turned into a path. If it is joined to a base folder with no check that the result stays inside that folder, your copy has the weakness. Also review which users and networks can reach the service, since the vector needs a local network position and a low privilege account.
What to do now
- Find every Upsonic deployment, including test and demo copies on shared networks.
- Check the project issue for any fix or workaround, and update to the first release that addresses it once one exists.
- Until then, restrict network access to the service so only trusted users reach it.
- Patch your own copy: join the filename to the base folder, resolve the final path, and refuse it unless it is still inside the base folder. Also strip directory parts with a basename function.
- Run the service as a low privilege user with write access only to the folder it needs, so a traversal cannot reach system files.
Why it matters
Path traversal (CWE-22) means a filename supplied by a user is trusted as part of a file path. Sequences that climb out of a directory can then point to places the author never meant to expose. With an upload function the result can be a file written in the wrong place, and with a download function it can be a file read that should have stayed private.
AI agent projects are an especially common home for this bug. They accept files from users, tools and other models, and they often run with broad access on a developer machine or a shared server. The issue is easy to fix in code and costly to ignore when the service has broad file access.
The record does not mark this CVE as CISA Known Exploited. It does say that exploit details are public.
Quick check
Is there a fixed version?
The record says versions up to 0.55.6 are affected and does not name a fixed version. I found no fixed release in the sources I fetched.
How do I prevent this in my own code?
Never use a client supplied filename directly. Generate your own file names, or take only the basename, join it to a fixed base folder, resolve the full path and confirm it still lies inside that folder.
Sources
Last reviewed: 18 October 2026.
