{"action":"Upgrade lightrag-hku to 1.3.8 or later.","affected":[{"fixed":"1.3.8","introduced":"0"}],"component":"lightrag-hku","cve_ids":["CVE-2025-6773"],"ecosystem":"PyPI","epss":0.00211,"exploited":false,"fixed_versions":["1.3.8"],"ghsa_id":"GHSA-v9w6-9hq9-33ch","id":"tcs_01M5KGT6QWPGHPTZM8C90EXX7G","modified_at":"2026-07-07T17:46:51.288990689Z","published_at":"2026-07-07T16:02:55.887572Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1539","https://nvd.nist.gov/vuln/detail/CVE-2025-6773","https://github.com/HKUDS/LightRAG/issues/1692","https://github.com/HKUDS/LightRAG/issues/1692#issuecomment-3009368235","https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf","https://github.com/HKUDS/LightRAG","https://vuldb.com/?ctiid.314089","https://vuldb.com/?id.314089","https://vuldb.com/?submit.601276","https://pypi.org/project/lightrag-hku","https://github.com/advisories/GHSA-v9w6-9hq9-33ch"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1539","url":"https://osv.dev/vulnerability/PYSEC-2026-1539"}],"summary":"HKUDS LightRAG allows Path Traversal via function upload_to_input_dir"}