Path Traversal in Langbot-App Langbot
CVE-2025-59835
LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.
EPSS: 0.004 (30.8th percentile) — read the EPSS interpretation.
Affected products
- Langbot-app Langbot — versions >= 4.1.0, < 4.3.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-59835?
- CVE-2025-59835 is a vulnerability in Langbot-App Langbot, classified under Relative Path Traversal. Published 2025-10-02.
- Is CVE-2025-59835 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.