CVE-2025-59835: LangBot has a cross-directory file upload vulnerability, which could lead to system takeover

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-02 · updated 2026-10-19
Weakness: CWE-23

Description

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

Affected products

langbot-app LangBot: from 4.1.0, < 4.3.5

References

https://github.com/langbot-app/LangBot/pull/1691
https://github.com/langbot-app/LangBot/releases/tag/v4.3.5
https://github.com/langbot-app/LangBot/security/advisories/GHSA-7j3j-qj83-9qv4

Get alerted when CVE-2025-59835 or the next vulnerability affects your stack