Path Traversal Vulnerabilities in LangChain-Chatchat: CVE-2025-6853, CVE-2025-6854 & CVE-2025-6855
Langchain-Chatchat is an open-source, locally deployable chatbot framework built on top of LangChain - a popular library for building LLM-powered applications. The project bridges large language models (LLMs) like OpenAI's GPT, Claude or LLaMA with user-uploaded documents or APIs, enabling private, knowledge-driven assistants that can answer natural language questions.
Recently, 3 path traversal vulnerabilities are discovered in different endpoints of LangChain’s Chatchat-space module which are tracked as CVE-2025-6853, CVE-2025-6854 and CVE-2025-6855. In this blog we will take a closer look at the traffic pattern of this attack, including how one can reproduce the vulnerable setup and exploitation.
Vulnerable Setup and Exploitation
Path traversal is a type of vulnerability (CWE-22) that occurs when user input is improperly validated, allowing attackers to manipulate file paths. By using sequences like “../”, they can access sensitive files outside the intended directory structure.
As per the information from MITRE and NIST, Langchain-Chatchat versions up to 0.3.1 are vulnerable to CVE-2025-6853, CVE-2025-6854, and CVE-2025-6855. These vulnerabilities arise due to insufficient sanitization of user-supplied path inputs across multiple file-handling endpoints, leading to path traversal, which can allow unauthorized access to files outside the intended directories. To understand and demonstrate these vulnerabilities in detail, ATI security researchers have created a local vulnerable environment using Langchain-Chatchat v0.3.1.
Figure 1: Vulnerable LangChain-Chatchat version deployed for PoC
Next, a POST request is sent to the “/v1/files?purpose=assistants” endpoint (as per CVE-2025-6855) of the locally hosted Langchain-Chatchat server to create a file containing specific content, as shown below:
Figure 2: Vulnerable LangChain-Chatchat server running in the PoC environment
As a result, the file is successfully created on the server with the specified content at the manipulated path, demonstrating the path traversal vulnerability.
Figure 3: Running PoC to exploit the vulnerability
Note: Similarly, the other two vulnerabilities CVE-2025-6853 and CVE-2025-6854 can be exploited via the “/knowledge_base/upload_temp_docs” and “/v1/files?purpose=assistants” endpoints respectively by manipulating user-controlled path inputs. This allows attackers to perform path traversal across different components of the Langchain-Chatchat backend.
Attack Traffic Analysis
Here is our observation based on the captured traffic –
CVE-2025-6853
In this case, the attacker exploits the “/knowledge_base/upload_temp_docs” endpoint by crafting a malicious filename in a multipart POST request. The filename includes path traversal sequences (../../../), allowing the file to be written outside the intended upload directory.
Figure 4: Crafted POST request targeting Langchain-Chatchat (CVE-2025-6853)
CVE-2025-6854
In this case, the attacker exploits the “/v1/files/<path>/content” endpoint by injecting base64-encoded path traversal sequences directly into the URL. When decoded, the input leads to sensitive files being accessed outside the intended directory.
Here, as an example, the attacker is trying to access or read the “/../../../../../../../../../../etc/passwd” directory by embedding multiple “../” sequences within a base64-encoded path in the URL.
Payload = “assistants/” + “yyyy-mm-dd” + “/” + directory_path
The entire string is then base64-encoded and appended to the /v1/files/<base64>/content endpoint to perform the path traversal.
Figure 5: Crafted GET request targeting Langchain-Chatchat (CVE-2025-6854)
CVE-2025-6855
In this case, the attacker targets the “/v1/files?purpose=assistants” endpoint by crafting a malicious filename in a multipart POST request. The filename contains multiple ../ sequences, allowing the file to be written outside the intended directory.
Figure 6: Crafted POST request targeting Langchain-Chatchat (CVE-2025-6855)
LangChain-Chatchat Path Traversal Strikes in BreakingPoint
At Keysight Technologies, our Application and Threat Intelligence (ATI) team, the security researchers have examined the attack traffic patterns of CVE-2025-6853, CVE-2025-6854 & CVE-2025-6855 and added 3 new (verified) Strikes in ATI-2025-16 StrikePack released on August 13, 2025, as shown below –
Figure 7: New Strike for CVE-2025-6853, CVE-2025-6854 and CVE-2025-6855 in BreakingPoint
Leverage Subscription Service to Stay Ahead of Attacks
Keysight's Application and Threat Intelligence subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously monitors threats as they appear in the wild. BreakingPoint and in the future, other tools like CyPerf, now provide customers with access to attack campaigns for different advanced persistent threats, enabling them to test their currently deployed security controls' ability to detect or block such attacks.