CVE-2025-45691

Katalog CVE

CVSS 7.5 · High EPSS 0,55%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada vibrantlabsai ragas. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrieved_contexts parameter when handling multimodal inputs.

Rincian

Terbit di NVD

5 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vibrantlabsai/ragas/pull/1991 exploit · issue tracking · patch · advisory vendor
• https://github.com/explodinggradients/ragas/pull/1559 exploit · issue tracking · patch
• https://adithyanak.com/ragas-v0214-arbitrary-file-read-vulnerability exploit · advisory pihak ketiga
• https://github.com/explodinggradients/ragas/blob/e97886ac976465efb60e5949c5d69baf30cc811d/src/ragas/prompt/mul... product
• https://access.redhat.com/security/cve/CVE-2025-45691
• https://bugzilla.redhat.com/show_bug.cgi?id=2444875
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-45691.json