CVE-2026-13509
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile — higher than 21% of all known CVEs
Summary
A vulnerability was found in RAGapp up to version 0.1.5 in the FileHandler.upload_file/FileHandler.remove_file function in src/ragapp/backend/controllers/files.py. This flaw allows remote path traversal attacks.
Risk Assessment
An attacker can remotely read or overwrite arbitrary files on the system, potentially leading to data leakage or application compromise.
Recommendation
Upgrade RAGapp to the patched version as soon as it is released, or implement temporary mitigations such as file path validation.
Original NVD description (English source)
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.