Ro1Me

RAGFlow 0.24.0 contains improper access control in get dataset (api/apps/evaluation app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution

In Devika v1.0, the Patcher Agent save code to project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.

In Devika v1.0, the Feature Agent save code to project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate last turn. A remote caller can enumerate or obtain a session id and trigger regenerate on another user's session.

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write bot file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.

**Nome do Software Vulnerável e Versões Afetadas** Langchain-Chatchat versão 0.3.0 **Description** O endpoint de upload de arquivos compatível com OpenAI `/v1/files` é suscetível a path traversal, uma condição onde um invasor pode acessar ou gravar arquivos fora do diretório pretendido. Ao criar nomes de arquivos maliciosos, um invasor pode gravar arquivos em locais arbitrários fora do diretório `openai files`. Este problema foi explorado em incidentes reais. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade. Restrinja o acesso ao endpoint `/v1/files` para minimizar o risco de exploração.

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..`) into the `knowledge base name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.

The /knowledge base/upload temp docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post validate code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post validate code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/backend/base/langflow/api/v1/knowledge bases.py:knowledge bases-create knowledge base-a-live-http-post-to-create-knowledge-base. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing upload or HTTP route handler forwards an attacker-controlled path or filename into host file creation without any visible boundary enforcement. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.8.4. langflow contains an absolute path traversal vulnerability in knowledge bases-create knowledge base-a-live-http-post-to-create-knowledge-base (src/backend/base/langflow/api/v1/knowledge bases.py:51). An attacker can write or overwrite files outside the intended working directory by providing absolute paths in the knowledge base creation endpoint.

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc id>.

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

Ragflow 0.24.0 and prior contains improper access control in update metadata setting (api/apps/kb app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save code to project function, which allows attackers to write files outside the intended project workspace.

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert text file.