CVE-2025-45150 in LangChain-ChatGLM-Webui
Summary
by MITRE • 08/01/2025
Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2025
The vulnerability identified as CVE-2025-45150 resides within the LangChain-ChatGLM-Webui application, specifically manifesting in insecure file permissions that enable unauthorized access to sensitive data. This issue stems from improper access control mechanisms within the web interface, allowing malicious actors to exploit a crafted request payload to view and download files that should remain protected. The vulnerability represents a critical security flaw in the application's authorization framework, where file access controls are inadequately enforced. The affected component operates within the context of a web-based user interface that facilitates interaction with language model services, making it a potential entry point for attackers seeking to exfiltrate confidential information.
The technical exploitation of this vulnerability occurs through manipulation of the application's request handling logic, where the system fails to properly validate user permissions before serving file content. Attackers can construct malicious requests that bypass normal access controls, potentially gaining access to configuration files, authentication credentials, model weights, or other sensitive data stored within the application's file system. This flaw demonstrates a classic path traversal or access control bypass vulnerability, where the application's permission model is insufficient to prevent unauthorized file access. The vulnerability's impact extends beyond simple information disclosure, as it could enable attackers to obtain sensitive operational data that might compromise the entire system's security posture.
The operational consequences of this vulnerability are severe, as it creates a persistent risk for organizations deploying LangChain-ChatGLM-Webui applications in production environments. Unauthorized access to sensitive files could lead to complete system compromise, especially if the application stores authentication tokens, API keys, or other credentials within accessible file paths. The vulnerability affects the application's integrity and confidentiality, potentially enabling attackers to escalate privileges or conduct further reconnaissance activities. Organizations using this web interface may face regulatory compliance violations if sensitive data is exposed, particularly in environments governed by standards such as iso 27001 or gdpr. The vulnerability's impact is amplified when the application is deployed in cloud environments or multi-tenant configurations where isolation between users is critical for maintaining security boundaries.
Mitigation strategies for CVE-2025-45150 should focus on implementing robust access control mechanisms within the LangChain-ChatGLM-Webui application. Security measures must include proper input validation and sanitization of all file access requests, implementation of role-based access controls, and enforcement of least privilege principles for file system access. Organizations should immediately patch the affected version and implement proper authentication checks before serving any file content. The solution should incorporate proper file path validation to prevent directory traversal attacks and ensure that all file access operations are properly authenticated and authorized. Additionally, implementing comprehensive logging and monitoring of file access operations can help detect and respond to potential exploitation attempts. This vulnerability aligns with CWE-284 Access Control Issues and can be categorized under ATT&CK technique T1213 Data from Information Repositories, highlighting the need for comprehensive security controls around information access and retrieval.