GHSA-62MM-XWMV-CRHG: Unauthenticated Path Traversal in Khoj Static File Serving Endpoint

The application Khoj is an open-source, self-hosted AI research copilot designed to aggregate, index, and query personal documents, integrating closely with various Large Language Models (LLMs). To support its default landing interface, the application exposes a public, unauthenticated HTTP endpoint designated for serving static files.

A path traversal vulnerability (classified as CWE-22) resides within this public asset serving routine. Because the application fails to validate the boundaries of user-supplied paths, remote unauthenticated attackers can escape the intended static asset directory.

This security bypass allows the retrieval of sensitive system and application files. Successful exploitation does not require active sessions or specialized user interaction, placing all deployments directly exposed to the internet at immediate risk of data exposure.

The root cause of this vulnerability lies in the implementation of the /home/{file_path:path} endpoint within src/khoj/routers/web_client.py. This route employs FastAPI's wildcard path converter ({file_path:path}), which accepts arbitrary sub-paths, including directory traversal sequences such as ../ and forward slashes.

To resolve the local file path, the application uses the Python standard library's pathlib module. The router directly concatenates the hardcoded base landing page directory constants.home_directory with the raw, user-supplied file_path string using the pathlib division (/) operator.

While the pathlib.Path class structures paths logically, its division operator does not perform canonicalization or prevent relative references from navigating outside the parent directory. When the resulting un-normalized path is passed directly to Starlette's FileResponse object, the underlying operating system resolves the relative directory segments and retrieves the target file. No security middleware or access filters were present to validate that the resolved file remained inside the designated static root directory.

The original vulnerable route in src/khoj/routers/web_client.py was implemented as follows:

@web_client.get("/home/{file_path:path}", response_class=FileResponse)
def home_static_files(file_path: str):
    """Serve static files from the home landing page directory"""
    # VULNERABLE: Direct concatenation of user input without sanitization or path resolution
    return FileResponse(constants.home_directory / file_path)

The remediation patch introduces validation using standard security patterns for Python's path handling:

@web_client.get("/home/{file_path:path}", response_class=FileResponse)
def home_static_files(file_path: str):
    """Serve static files from the home landing page directory"""
    # FIXED: Fully resolve the path, evaluating symlinks and stripping relative sequences
    resolved = (constants.home_directory / file_path).resolve()
    
    # FIXED: Verify that the resolved absolute path remains within the base directory boundaries
    if not resolved.is_relative_to(constants.home_directory.resolve()):
        raise HTTPException(status_code=404)
    return FileResponse(resolved)

By adding the .resolve() method call, the system resolves any symbolic links and strips out redundant relative directory path elements. The addition of is_relative_to() acts as a strong logical containment check, ensuring that any resolution resulting in a location outside of the base directory is immediately aborted with an HTTP 404 error.

Exploitation of this vulnerability requires only network-level access to the running Khoj instance. Because the endpoint does not perform any session or identity verification, an attacker can directly submit malformed GET requests to extract targeted system files.

In a standard Linux deployment environment, an attacker can construct directory traversal payloads designed to escape the web root folder. By utilizing multiple URL-encoded or raw ../ sequences, the file system boundary is bypassed.

An example attack request targeting /etc/passwd appears as follows:

GET /home/../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: target-khoj-instance:8000
Connection: close

When processed, the backend concatenates this payload with the internal path. The OS evaluates this to /etc/passwd and returns the target file's content in a 200 OK response. Beyond operating system configuration files, attackers can specifically target application-specific assets. This includes the internal SQLite database (khoj.db) which contains private user document indices and plain-text API credentials.

The impact of this path traversal vulnerability is evaluated as High. Due to the nature of Khoj as a personal AI assistant, compromised instances expose extremely sensitive data assets.

Attackers can download the application database, which typically holds indexed local documents, proprietary enterprise notes, and private communication histories. This represents a complete breach of confidentiality for self-hosted instances containing sensitive personal or organizational information.

Furthermore, the configuration files often store active third-party API tokens for services like OpenAI, Anthropic, Gemini, and Deepseek. Exfiltration of these tokens can result in financial loss, API rate limit exhaustion, and potential secondary compromises of connected cloud ecosystems.

To fully address this vulnerability, administrators must upgrade their Khoj deployments to version 2.0.0-beta.25 or higher. This version natively integrates secure path resolution and containment checking.

If immediate patching is not possible, system administrators should deploy restrictive rules on reverse proxies or web application firewalls (WAFs). Ingress traffic filters can block requests directed to /home/ that contain dot-dot-slash patterns or equivalent hexadecimal encodings.

As a secure deployment practice, ensure the Khoj application runs within an isolated environment under a dedicated, low-privilege system user account. Limiting the execution account's filesystem read permissions ensures that even if a path traversal vulnerability is exploited, the attacker's visibility is confined only to non-critical files.