A path traversal flaw exists in RAGapp versions up to 0.1.5 within the FileHandler.upload_file and FileHandler.remove_file functions. The flaw allows an attacker to craft a file path that escapes the intended knowledge file directory and delete or upload files outside that area, thereby compromising data integrity and potentially enabling a denial‑of‑service or further exploitation.

The vulnerability affects the RAGapp product, specifically the Knowledge File Handler component of the backend. All releases up to version 0.1.5 are impacted.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation at this time. However, the attack vector is remote and does not require elevated privileges within the application, so anyone with network access to the RAGapp API could exercise the path traversal to delete files.