RAGapp versions 0.1.0 to 0.1.5 contain a path traversal vulnerability in the FileHandler.upload_file and FileHandler.remove_file functions located in src/ragapp/backend/controllers/files.py. This flaw allows remote attackers to manipulate file paths, potentially leading to unauthorized file access. The vulnerability has been publicly disclosed, and a fix is pending acceptance of a pull request. No official patch or remediation has been released at this time.

Exploitation of this vulnerability could allow an attacker to access or manipulate files outside the intended directories by leveraging path traversal. This could lead to unauthorized disclosure or modification of files on the affected system. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges.

No official fix or patch is currently available. A pull request addressing the vulnerability has been submitted but is awaiting acceptance. Users should monitor the vendor's repository or advisory channels for the official patch and apply it promptly once released. Until then, consider restricting access to the affected functions or implementing additional input validation controls to mitigate exploitation risk.