Chainlit
CVE-2026-22218
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 14, 2026
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated user disclose any file readable by the Chainlit service process by abusing the /project/element update flow with a user-controlled path. The server copies the referenced file into the attacker's session and returns a chainlitKey usable at /project/file/<chainlitKey> to exfiltrate contents. Publicly available exploit code exists (documented as part of the 'ChainLeak' research by Zafran), though EPSS is very low (0.03%) and it is not on CISA KEV.
Earlier versions of this analysis (2)
Arbitrary file read in Chainlit versions prior to 2.9.4 lets an authenticated client disclose any file readable by the Chainlit service by abusing the /project/element update flow. By submitting a custom Element with a user-controlled path, the server copies the referenced file into the attacker's session and returns a chainlitKey that retrieves the contents via /project/file/<chainlitKey>. Publicly available exploit code exists (documented as part of the 'ChainLeak' research by Zafran), though EPSS remains low (0.03%) and it is not listed in CISA KEV.
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. [CVSS 6.5 MEDIUM]
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Chainlit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated (PR:L) low-complexity network request to a standard endpoint yields arbitrary file read, so C:H with no integrity or availability impact and unchanged scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.
Executive ViewAI
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability affecting authenticated users, with publicly available exploit code now in circulation. The flaw allows exfiltration of any files readable by the Chainlit service process, potentially exposing configuration files, credentials, and sensitive application data. Organizations must upgrade immediately to prevent data breach and unauthorized access.
Within 24 hours, conduct a complete inventory of Chainlit deployments and record version numbers. Within 7 days, upgrade all instances to Chainlit version 2.9.4 or later. Within 30 days, analyze file access logs from the exposure period to identify potential data exfiltration, restrict the Chainlit service process to minimum required file system permissions, and review any exposed credential material for compromise indicators.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to t
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attac
Session hijacking in Chainlit before 2.10.1 allows remote attackers with a valid victim sessionId to inherit an authenti
Unauthenticated remote directory deletion in Chainlit through 2.12.0 allows any network-accessible attacker to recursive
Server-side request forgery in Chainlit's MCP client path lets an unauthenticated remote user slip past path-scoped allo
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other u
Exploit-DB