{"action":"Upgrade upsonic to 0.56.0 or later.","affected":[{"fixed":"0.56.0","introduced":"0"}],"component":"upsonic","cve_ids":["CVE-2025-6278"],"ecosystem":"PyPI","epss":0.00702,"exploited":false,"fixed_versions":["0.56.0"],"ghsa_id":"GHSA-8jf4-fcjr-68c2","id":"tcs_01M5KGPTAB5W3RWSF67PCMDFZD","modified_at":"2026-06-10T17:02:48.115944048Z","published_at":"2025-06-19T21:15:27Z","references":["https://osv.dev/vulnerability/PYSEC-2025-67","https://vuldb.com/?ctiid.313282","https://vuldb.com/?id.313282","https://vuldb.com/?submit.593096","https://github.com/Upsonic/Upsonic/issues/356","https://github.com/advisories/GHSA-8jf4-fcjr-68c2"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2025-67","url":"https://osv.dev/vulnerability/PYSEC-2025-67"}],"summary":"A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.fil"}