{"action":"Upgrade lightrag-hku to 1.3.8 or later.","affected":[{"fixed":"1.3.8","introduced":"0"}],"component":"lightrag-hku","cve_ids":["CVE-2025-6773"],"ecosystem":"PyPI","epss":0.00211,"exploited":false,"fixed_versions":["1.3.8"],"ghsa_id":"GHSA-v9w6-9hq9-33ch","id":"tcs_01M5KFZTG39E6SJSVKJRJZ17Q4","modified_at":"2026-07-07T17:57:09.013178245Z","published_at":"2025-06-27T21:30:29Z","references":["https://osv.dev/vulnerability/GHSA-v9w6-9hq9-33ch","https://nvd.nist.gov/vuln/detail/CVE-2025-6773","https://github.com/HKUDS/LightRAG/issues/1692","https://github.com/HKUDS/LightRAG/issues/1692#issuecomment-3009368235","https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf","https://github.com/HKUDS/LightRAG","https://vuldb.com/?ctiid.314089","https://vuldb.com/?id.314089","https://vuldb.com/?submit.601276"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-v9w6-9hq9-33ch","url":"https://osv.dev/vulnerability/GHSA-v9w6-9hq9-33ch"}],"summary":"HKUDS LightRAG allows Path Traversal via function upload_to_input_dir"}