CVE-2025-59835
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-02

Last updated on: 2025-10-06

Assigner: GitHub, Inc.

Description
LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-10-02
Last Modified
2025-10-06
Generated
2026-07-06
AI Q&A
2025-10-02
EPSS Evaluated
2026-07-05
NVD
CVE-2025-59835
EUVD
EUVD-2025-33219

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
langbot langbot 4.3.5
langbot langbot 4.1.0
langbot langbot 4.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in LangBot versions 4.1.0 up to but not including 4.3.5 allows authorized attackers to exploit the /api/v1/files/documents interface to upload arbitrary files. Because the interface does not strictly restrict where files are stored on the server, attackers can upload dangerous files to specific system directories, potentially compromising the system. This issue is fixed in version 4.3.5.

Impact Analysis

The vulnerability can allow attackers to upload malicious files to critical system directories, which may lead to system compromise, unauthorized code execution, or disruption of services. This poses a significant security risk to the affected system.

Mitigation Strategies

Upgrade LangBot to version 4.3.5 or later, as this version fixes the arbitrary file upload vulnerability in the /api/v1/files/documents interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart