Executive brief
HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
Affected products
- PyPI lightrag-hku
Junglewise Threat Intelligence
CVE-2025-6773: PYSEC-2026-1539 - HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
CVE-2025-6773 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: lightrag-hku (PyPI). Vendors: PyPI.
Related threats
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx re
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.p
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plai
- LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text