CVE-2025-45150
Critical · CVSS 9.8LangChain-ChatGLM-Webui — Insecure File Permissions / Arbitrary File Read and Download
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-732
Description
Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.
Search profile — drives PoC discovery
Symbols ef829crafted requestsensitive filesfile downloadfile viewX-D-Lab/LangChain-ChatGLM-Webui
Keywords CVE-2025-45150LangChain-ChatGLM-Webuiinsecure permissionsarbitrary file readarbitrary file downloadsensitive file exposureCWE-732ef829X-D-LabChatGLM webui PoC
Versions: commit ef829
Ranked PoCs (3) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0ecnusse/Hydrangea needs reviewtrickest
- ★ 0fkie-cad/nvd-json-data-feeds needs reviewtrickest
- ★ 0thexnumb/thexwriteup needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z