CVE-2025-6853 is a medium (CVSS 6.3) path traversal flaw in Langchain-Chatchat up to 0.3.1. The upload_temp_docs backend function can write uploaded files outside the intended folder. The record names no fixed version, and the public issue shows no maintainer response, so restrict access to the endpoint.
What's affected
Langchain-Chatchat up to 0.3.1, per the record. The affected function is upload_temp_docs, behind the /knowledge_base/upload_temp_docs endpoint of the backend.
Two sources differ slightly. The record says the manipulation of the flag argument leads to path traversal. The public GitHub issue (number 5352, opened 19 June 2025) says the endpoint uses the uploaded filename directly when building the save path, in the parse_file function of chatchat/server/chat/file_chat.py. The issue gives no version range. They may describe the same weakness from two angles, and I could not settle which input is the exact trigger.
Severity also differs in framing. The NVD description calls the flaw critical, which is the reporting database label. The CVSS 3.1 score in the record is 6.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which is Medium, and the vector lists low privileges required. The issue reporter suggests the endpoint lacks authentication. Check how your deployment is exposed.
How to check if you're exposed
Find the version you run:
pip show langchain-chatchat
Check whether the backend is reachable from outside your trusted network, and whether anything in front of it requires a login:
grep -rn "upload_temp_docs" /path/to/chatchat 2>/dev/null
Look in your web or reverse proxy logs for requests to that endpoint from addresses you do not recognize:
grep "upload_temp_docs" /var/log/nginx/access.log | tail -50
If the app runs on a shared host, also look for unexpected files outside the temporary upload folder, particularly in application or configuration directories.
What to do now
- Take the Chatchat backend off the public internet. Put it behind a VPN, an authenticated reverse proxy or an allow list.
- Block or require authentication for
/knowledge_base/upload_temp_docsat the proxy if your users do not need it. - Run the service as an unprivileged user that can write only to its own data folders.
- Watch the project for a fix. As of the issue page I read, it was closed automatically as stale on 2 August 2025 with no linked pull request, so do not wait on a patch.
- If you maintain a fork, validate the filename on the server and resolve the final path before saving, rejecting anything that leaves the upload folder.
Why it matters
CWE-22 (path traversal) happens when a program builds a file path from outside input and does not confirm the result stays inside the folder it meant to use. With an upload feature, the damage is a file written somewhere unplanned. Depending on where it lands and what the service account can write, that can mean overwriting data or configuration.
The issue reporter describes the potential impact as serious, including overwriting important files. The CVSS score rates confidentiality, integrity and availability each as low, so the official score is more modest than the reporter's wording. Weigh it by where your instance runs and what the service account can write.
LLM chat front ends are often stood up quickly for internal use and left reachable. That is the setting where a flaw like this matters most. It is not on the CISA Known Exploited Vulnerabilities list (KEV false in the record).
Quick check
Is there a fixed version of Langchain-Chatchat?
The record names none, and the public issue shows no fix or maintainer reply. Check the project repository for newer releases and restrict access in the meantime.
Is this critical or medium?
The NVD description uses the word critical, but the CVSS 3.1 base score in the record is 6.3, which is Medium. This post uses the score.
Sources
Last reviewed: 18 October 2026.
