CVEvulnerability

CVE-2025-59835

8.6 HIGH Published 2025-10-02 Modified 2026-10-19 Official page ↗

Status: Deferred
Published: 2025-10-02
Last modified: 2026-10-19
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-23, CWE-434

Description

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

Weakness · CWE (2)

CWE-23 Relative Path Traversal weakness
CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References

https://github.com/langbot-app/LangBot/pull/1691 github.com
https://github.com/langbot-app/LangBot/releases/tag/v4.3.5 github.com
https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4 github.com

CVE-2025-59835

Description

Related

Weakness · CWE (2)

References