CVE WatchJul 5, 2026

CVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying

CVSS

9.8

Critical

EPSS

0.5%

p41

KEV

—

Exploit Today

0-100

Published: Aug 1, 2025 · Last modified: Jul 5, 2026 · CWE-732

EPSS · 30d

0.5%EPSS · 30 days0.6%

2026-06-302026-07-17

Technical description

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-341107.8 HIG

63.4%

——19WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.9d CVE-2017-176778.8 HIG

60.5%

——18BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.9d CVE-2022-262817.5 HIG

56.5%

——17BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.9d CVE-2023-317487.8 HIG

53.4%

——16Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.9d CVE-2023-390049.8 CRI

52.0%

——16Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.9d CVE-2021-406496.5 MED

51.6%

——15In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set.9d