---
id: CVE-2026-13509
title: A vulnerability has been found in RAGapp up to 0.1.5
summary: >-
  A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function
  FileHandler.upload_file/FileHandler.remove_file of the file
  src/ragapp/backend/controllers/files.py of the component Knowledge File
  Handler. Such manipulation…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-22
published: '2026-06-28'
updated: '2026-06-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13509'
references:
  - url: 'https://github.com/ragapp/ragapp/'
    label: cna@vuldb.com
  - url: 'https://github.com/ragapp/ragapp/issues/293'
    label: cna@vuldb.com
  - url: 'https://github.com/ragapp/ragapp/pull/294'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-13509'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/838838'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/374517'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/374517/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-06-29T13:42:12.239Z'
epss: 0.00425
epssPercentile: 0.3411
---

## Overview

A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.