{"uuid": "1d199d86-b6bd-4ae3-ac4c-088d4e59f96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-62MM-XWMV-CRHG", "type": "seen", "source": "https://gist.github.com/alon710/cd808a0773f21e3705390b5760dfe75e", "content": "# GHSA-62MM-XWMV-CRHG: GHSA-62MM-XWMV-CRHG: Unauthenticated Path Traversal in Khoj Static File Serving Endpoint\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/GHSA-62MM-XWMV-CRHG\n\n## Summary\nAn unauthenticated path traversal vulnerability exists in the Khoj AI assistant platform via the static file serving endpoint `/home/{file_path:path}`. Due to improper path sanitization when handling user input with Python's pathlib module, a remote attacker can read arbitrary files from the server's filesystem.\n\n## TL;DR\nAn unauthenticated path traversal flaw in Khoj enables remote attackers to read sensitive files, databases, and API keys by using directory traversal sequences on the static landing page file router.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Path Traversal)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n- **Mitigated Version**: 2.0.0-beta.25\n\n## Affected Systems\n\n- Khoj AI Assistant Deployments running versions >= 2.0.0-beta.20 and < 2.0.0-beta.25\n- **khoj**: >= 2.0.0-beta.20, < 2.0.0-beta.25 (Fixed in: `2.0.0-beta.25`)\n\n## Mitigation\n\n- Upgrade Khoj to version 2.0.0-beta.25 or later.\n- Implement ingress blocklists on reverse proxies for path traversal character sequences targeting the `/home/` endpoint.\n- Run the Khoj service using a dedicated, low-privilege user account to restrict backend filesystem access.\n\n**Remediation Steps:**\n1. Identify the running version of Khoj in your self-hosted environment.\n2. Update the installation using the appropriate package manager or Docker pull command to retrieve version 2.0.0-beta.25 or above.\n3. Restart the Khoj service to apply the path verification patch.\n4. Verify the remediation by attempting to access a test file outside the web root via the `/home/` route and ensuring an HTTP 404 is returned.\n\n## References\n\n- [GitHub Advisory GHSA-62MM-XWMV-CRHG](https://github.com/advisories/GHSA-62MM-XWMV-CRHG)\n- [Remediation Commit](https://github.com/khoj-ai/khoj/commit/21c51b9ace4eb59ce79ac0a93b917289824195cf)\n- [Introduction Commit](https://github.com/khoj-ai/khoj/commit/9801ffd2de642772f072ca496032b7c352013b6a)\n- [Khoj 2.0.0-beta.25 Release](https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.25)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-62MM-XWMV-CRHG) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T05:30:29.000000Z"}