Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2025-27519 EUVD-2025-7790

Cognita Arbitrary File Write

Published Mar 7, 2025 · Updated Mar 7, 2025 · Assigned by GitHub_M

Vendor: truefoundry Product: cognita

Description

Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setup using Docker. Because the docker environment sets up the backend uvicorn server with auto reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded and executed. This allows an attacker to get remote code execution in the context of the Docker container. This vulnerability is fixed in commit a78bd065e05a1b30a53a3386cc02e08c317d2243.

Affected products

VendorProductAffectedFixed
truefoundry cognita < a78bd065e05a1b30a53a3386cc02e08c317d2243 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Diabl0xE/CVE-2025-27519 ★ 2 · Aug 22, 2025

    PoC exploit for Below privilege escalation (CVE-2025-27591) allowing local root access via symlink manipulation in world-writable log directory.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References