CVE-2025-6773: 
Python vulnerability analysis and mitigation

CVE-2025-6773 is a path traversal vulnerability in HKUDS LightRAG, an AI-powered Retrieval-Augmented Generation framework, affecting versions up to and including 1.3.8. The flaw resides in the upload_to_input_dir function within lightrag/api/routers/document_routes.py, where unsanitized user-controlled filenames are used to construct file paths. It was reported on June 20, 2025 (GitHub issue #1692), published to NVD on June 27, 2025, and patched the same day. The vulnerability carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 4.8 (Medium) (Github Advisory, Red Hat).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), classified as a path traversal vulnerability. At line 802 of document_routes.py, the destination file path is constructed directly as file_path = doc_manager.input_dir / file.filename without any sanitization of the file.filename parameter, which is entirely user-controlled. An attacker with low-privilege local access can craft a filename containing directory traversal sequences (e.g., ../../../etc/cron.d/malicious) to write files to arbitrary locations outside the intended input directory. The patch (commit 60777d535b719631680bcf5d0969bdef79ca4eaf) introduces a sanitize_filename() function that strips path separators, traversal sequences (..), control characters, and verifies the resolved path remains within the input directory using Path.resolve() (GitHub Issue, GitHub Commit).

Successful exploitation allows an authenticated low-privilege attacker to write arbitrary files to unintended locations on the server's filesystem, bypassing the intended input directory constraints. This could enable placement of malicious scripts (e.g., web shells, cron jobs, configuration overrides) in sensitive directories, potentially leading to privilege escalation or persistent access. The confidentiality, integrity, and availability impacts are each rated low in isolation, but the ability to write attacker-controlled content to arbitrary paths represents a meaningful risk to system integrity (Github Advisory, GitHub Issue).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The attack vector is local, requiring low-privilege credentials on the host running LightRAG, which limits the attack surface. The EPSS score is approximately 0.016% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Github Advisory, Red Hat).

1. Reconnaissance: Identify a LightRAG instance (version ≤ 1.3.8) running locally or accessible with low-privilege credentials. Note that the LightRAG Server Settings page may expose the input directory path, aiding targeting.
2. Authenticate: Obtain low-privilege credentials to the LightRAG API (e.g., a standard user account).
3. Craft malicious filename: Prepare a file upload request with a filename containing directory traversal sequences, such as ../../../etc/cron.d/backdoor or ../../../../tmp/shell.py.
4. Submit upload request: Send a multipart HTTP POST request to the document upload endpoint (e.g., /documents/upload) with the crafted filename and a malicious file payload (e.g., a Python reverse shell or cron job entry).
5. Achieve objective: The server writes the uploaded file to the attacker-specified path outside the intended input directory, potentially enabling code execution, persistence, or further system compromise (GitHub Issue, GitHub Commit).

• Network: HTTP POST requests to the LightRAG document upload endpoint (e.g., /documents/upload) with filenames containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in the multipart form data.
• File System: Unexpected files appearing outside the configured LightRAG input directory, particularly in sensitive locations such as /etc/cron.d/, /tmp/, web-accessible directories, or application configuration paths; files with unusual extensions (.py, .sh, .conf) in non-standard locations owned by the LightRAG service account.
• Logs: LightRAG application logs showing file upload requests with filenames containing path separators or .. sequences; HTTP 200 responses to upload requests with suspicious filenames that were not rejected with HTTP 400 errors (indicating an unpatched version).
• Process: Unexpected processes spawned by the LightRAG service account, particularly shells or interpreters, which may indicate execution of a dropped payload.

The fix is available in commit 60777d535b719631680bcf5d0969bdef79ca4eaf on the LightRAG GitHub repository. Users should upgrade to a version of lightrag-hku (pip package) beyond 1.3.8 that includes this patch. As interim mitigations: restrict local access to the LightRAG application to trusted users only; implement OS-level file system permissions to limit the directories writable by the LightRAG service account; and monitor file upload logs for suspicious filename patterns. Applying the patch is the only definitive remediation (GitHub Commit, Github Advisory).

The vulnerability was noted by RedPacketSecurity on Mastodon and included in a CISA vulnerability summary for the week of June 23, 2025. Red Hat tracked the CVE in their security advisory database. Community reaction has been minimal given the local-only attack vector and moderate severity rating; no significant vendor statements or researcher commentary beyond the original bug report and patch have been identified (Red Hat).