CVE-2025-59835

LangBot has a cross-directory file upload vulnerability, which could lead to system takeover

State: Published
Severity: 8.6 High
Published: Oct 2, 2025
Updated: Oct 2, 2025
Reserved: Sep 22, 2025

Description

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	GitHub_M

Weaknesses

CWE-23 Relative Path Traversal
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
LangBotlangbot-app	>= 4.1.0, < 4.3.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.