LangChain versions before 1.3.9 contain a path traversal vulnerability where components that handle filesystem paths or glob patterns fail to restrict resolved paths within a trusted root directory. This includes middleware that validates starting directories but not search patterns or symlink targets, loaders that resolve paths without confinement or symlink rejection, and authorization checks that use string prefix comparison without proper path-segment boundaries. When these components process path inputs influenced by untrusted sources, including LLMs acting on untrusted input, files outside the intended directory can be disclosed. The vulnerability is addressed in version 1.3.9.

An attacker able to influence path inputs or search patterns can cause the application to disclose files outside the intended directory boundaries. This leads to unauthorized information disclosure (confidentiality impact). There is no indication of integrity or availability impact. The CVSS score is 5.1 (medium severity) reflecting local attack vector with high complexity and no privileges required.

Upgrade to langchain version 1.3.9 or later, where this path traversal vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid processing untrusted input in path or search pattern fields that could influence filesystem access.