CVE-2026-13509: Path Traversal in RAGapp
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
AI Analysis
Technical Summary
RAGapp versions 0.1.0 to 0.1.5 contain a path traversal vulnerability in the FileHandler.upload_file and FileHandler.remove_file functions located in src/ragapp/backend/controllers/files.py within the Knowledge File Handler component. This vulnerability allows remote attackers to manipulate file paths, potentially leading to unauthorized file access or modification. Although a pull request to fix the issue has been submitted, it has not yet been merged or officially released. The vulnerability is publicly disclosed, but no known exploits are reported in the wild. The CVSS 4.0 base score is 5.3, indicating medium severity.
Potential Impact
The vulnerability enables remote attackers to perform path traversal attacks via the affected file handling functions, potentially allowing unauthorized access to or manipulation of files on the server. This could lead to information disclosure or modification of files outside the intended directory scope. However, there are no reports of active exploitation in the wild at this time.
Mitigation Recommendations
No official fix or patch is currently available as the pull request to address the vulnerability is pending acceptance. Users should monitor the vendor or project repository for updates and apply the official patch once released. Until then, restricting access to the affected functions and implementing additional access controls may help reduce risk.
CVE-2026-13509: Path Traversal in RAGapp
Description
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/ragapp/ragappcpe:2.3:a:ragapp:ragapp:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RAGapp versions 0.1.0 to 0.1.5 contain a path traversal vulnerability in the FileHandler.upload_file and FileHandler.remove_file functions located in src/ragapp/backend/controllers/files.py within the Knowledge File Handler component. This vulnerability allows remote attackers to manipulate file paths, potentially leading to unauthorized file access or modification. Although a pull request to fix the issue has been submitted, it has not yet been merged or officially released. The vulnerability is publicly disclosed, but no known exploits are reported in the wild. The CVSS 4.0 base score is 5.3, indicating medium severity.
Potential Impact
The vulnerability enables remote attackers to perform path traversal attacks via the affected file handling functions, potentially allowing unauthorized access to or manipulation of files on the server. This could lead to information disclosure or modification of files outside the intended directory scope. However, there are no reports of active exploitation in the wild at this time.
Mitigation Recommendations
No official fix or patch is currently available as the pull request to address the vulnerability is pending acceptance. Users should monitor the vendor or project repository for updates and apply the official patch once released. Until then, restricting access to the affected functions and implementing additional access controls may help reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-28T06:23:18.135Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a419e6c27e9c79719b3497c
Added to database: 06/28/2026, 22:21:32 UTC
Last enriched: 07/05/2026, 23:22:16 UTC
Last updated: 08/12/2026, 16:36:19 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.