GHSA-v9w6-9hq9-33ch

Suggest an improvement
Source
https://github.com/advisories/GHSA-v9w6-9hq9-33ch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-v9w6-9hq9-33ch/GHSA-v9w6-9hq9-33ch.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v9w6-9hq9-33ch
Aliases
Published
2025-06-27T21:30:29Z
Modified
2025-06-30T12:27:13.943368Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
Details

A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadtoinputdir of the file lightrag/api/routers/documentroutes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "github_reviewed_at": "2025-06-30T11:45:58Z",
    "github_reviewed": true,
    "nvd_published_at": "2025-06-27T19:15:31Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE"
}
References

Affected packages

PyPI / lightrag-hku

Package

Name
lightrag-hku
View open source insights on deps.dev
Purl
pkg:pypi/lightrag-hku

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.8

Affected versions

0.*

0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9

1.*

1.0.0
1.0.1
1.0.3
1.0.5
1.0.6
1.0.8
1.0.9
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.2.1
1.2.2
1.2.3
1.2.5
1.2.6
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7