What is GHSA-8v8h-4pjx-rg73?

GHSA-8v8h-4pjx-rg73 is a security advisory published by GitHub Security Advisories with Low severity. Langchain-Chatchat vulnerable to path traversal

Which CVE IDs does GHSA-8v8h-4pjx-rg73 cover?

GHSA-8v8h-4pjx-rg73 covers the following CVE IDs: CVE-2025-6854. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8v8h-4pjx-rg73?

GHSA-8v8h-4pjx-rg73 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-8v8h-4pjx-rg73?

GHSA-8v8h-4pjx-rg73 affects 1 product, including: pip/langchain-chatchat:\u003c= 0.3.1.

GHSA-8v8h-4pjx-rg73LowCVSS 4.3

Langchain-Chatchat vulnerable to path traversal

Vendor

GitHub Security Advisories

Published

June 29, 2025

Last Modified

November 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-6854 →

📋 Description

A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1. This vulnerability affects unknown code of the file /v1/files?purpose=assistants. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

🎯 Affected products1

pip/langchain-chatchat:<= 0.3.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-6854
https://github.com/chatchat-space/Langchain-Chatchat/issues/5353
https://vuldb.com/?ctiid.314326
https://vuldb.com/?id.314326
https://vuldb.com/?submit.601161
https://github.com/advisories/GHSA-8v8h-4pjx-rg73