# LangChain LocalFileStore Path Traversal Invocation

- **Severity:** High
- **Signature ID:** `6f1a7c92-3d84-4e05-9b7c-2a5f0c1d84e3`

## Summary

LangChain's LocalFileStore, a simple file-based cache used by AI agents, does not clean up the file paths it builds from caller-supplied keys. An attacker who can influence a key value can use '../' sequences to escape the intended storage folder and read or write files anywhere the agent process has permission to touch.

## How the attack works

An AI agent tool call ends up running an inline Python command (e.g. python -c) that imports LangChain's LocalFileStore and calls one of its key-based methods: mset, mget, mdelete, or yield_keys. If the key passed to that method contains a directory-traversal sequence like '../../../etc/cron.d/payload', LocalFileStore joins it onto its root directory without checking the result, so the operation lands outside the intended cache directory. This lets the attacker read sensitive files or write a new file - such as a cron job or config - with the same privileges as the agent process.

## Why it matters

Arbitrary file read or write on the host running the agent, which can lead to secret disclosure, configuration tampering, or persistence (e.g. planting a scheduled task) - all at the privilege level of the agent process.

## What you can do

- Pin LangChain to a version that sanitises or rejects traversal sequences in LocalFileStore keys, or wrap key inputs with your own path-normalisation and root-containment check before use.
- Never construct LocalFileStore keys directly from user or model-generated input; validate against an allow-list of expected key patterns.
- Run agent processes with the minimum filesystem permissions needed, so a successful traversal has limited reach.
- Review command-line logs for python -c/python3 -c invocations that combine LocalFileStore with mset/mget/mdelete/yield_keys and a '../' sequence, and treat this as one step of a larger chain rather than proof the write succeeded.

## Known benign look-alikes

- Developer or CI job running a LangChain example, notebook export, or ad-hoc one-liner that points LocalFileStore at a relative cache root such as ../../.cache and immediately calls mset/mget. Partially suppressed by the test-runner and packaging filters, and by requiring multi-level or sensitive-target traversal rather than any single "../".
- Deliberate CVE reproduction or red-team validation of this exact issue in a sandbox. This is a true positive by pattern and is intentionally reported.
- Security tooling or code search that prints a vulnerable snippet containing all three anchors on one command line - suppressed by filter_readonly_inspection.
- Documentation or scaffold generators emitting template paths such as ../../path/to/cache - suppressed by filter_doc_placeholders.

## References

- https://cwe.mitre.org/data/definitions/22.html
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
- https://owasp.org/Top10/A03_2021-Injection/
- https://python.langchain.com/docs/integrations/stores/file_system/

---
Source: https://www.netzilo.com/threats/langchain-localfilestore-path-traversal