{"id":68,"date":"2026-10-29T06:38:42","date_gmt":"2026-10-29T06:38:42","guid":{"rendered":"https:\/\/bugskan.com\/?p=68"},"modified":"2026-10-29T06:38:42","modified_gmt":"2026-10-29T06:38:42","slug":"historical-advisory-langchain-localfilestore-paths-could-escape-their-directory","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/historical-advisory-langchain-localfilestore-paths-could-escape-their-directory\/","title":{"rendered":"Historical advisory: LangChain LocalFileStore paths could escape their directory"},"content":{"rendered":"<p>A reviewed April 2024 advisory describes path traversal in LangChain\u2019s LocalFileStore. Inadequate validation in its storage operations could allow paths to reach outside the intended directory, exposing files or allowing writes. The advisory also describes possible code-execution consequences.<\/p>\n<p>The package table lists versions before 0.0.353 as affected. This is historical coverage and should not be interpreted as evidence of a new campaign.<\/p>\n<p>For inherited systems, identify whether LocalFileStore receives user-influenced names and compare the installed package with the advisory. A storage directory setting should not be assumed to enforce confinement by itself. Update affected dependencies and limit the filesystem permissions of the application process.<\/p>\n<p><a href=\"https:\/\/github.com\/advisories\/GHSA-rgp8-pm28-3759\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The LocalFileStore issue concerns filesystem boundaries around user-influenced paths.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_f3b28cfcef69dd","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"LangChain LocalFileStore","bugskan_recommended_next_step":"Check CVE-2024-3571 and update affected dependencies.","bugskan_who_should_check":"Maintainers using LocalFileStore in legacy LangChain deployments.","bugskan_material_updated_at":"2024-04-16T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[20],"class_list":["post-68","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-langchain"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/68","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=68"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/68\/revisions"}],"predecessor-version":[{"id":305,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/68\/revisions\/305"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=68"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=68"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=68"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=68"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=68"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}