CVE-2025-6855: Langchain-Chatchat vulnerable to path traversal

June 29, 2025 (updated November 3, 2025)

A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This issue affects some unknown processing of the file /v1/file. The manipulation of the argument flag leads to path traversal. The exploit has been disclosed to the public and may be used.

References

github.com/advisories/GHSA-f823-phmg-x5fr
github.com/chatchat-space/Langchain-Chatchat
github.com/chatchat-space/Langchain-Chatchat/issues/5354
nvd.nist.gov/vuln/detail/CVE-2025-6855
vuldb.com/?ctiid.314327
vuldb.com/?id.314327
vuldb.com/?submit.601162

Code Behaviors & Features

Detect and mitigate CVE-2025-6855 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →