Langchain-Chatchat CVE-2026-51882

Exploitation requires that the Langchain-Chatchat 0.3.0 OpenAI-compatible API server is running and its /v1/files upload endpoint is network-reachable by the attacker; the attacker then supplies a malicious filename containing path-traversal sequences to escape the openai_files directory. No special product feature toggle or non-default configuration is indicated in the description, and per the CVSS vector no authentication or user interaction is required (PR:N/UI:N) - so against a default, exposed deployment this is remote and unauthenticated. The primary limiting factors are therefore network exposure of the API (deployments bound to localhost or behind authenticated gateways are not directly reachable) and pinning to the specific vulnerable 0.3.0 release; actual write impact also depends on filesystem permissions of the service account.

Signals conflict in a way that lowers real-world urgency below the headline CVSS 9.1. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, low-complexity network flaw, which is consistent with an exposed OpenAI-compatible API endpoint, and a public PoC exists (the Ro1ME gist), so publicly available exploit code exists. Against that, EPSS is only 0.14% (3rd percentile) and the CVE is NOT on CISA KEV, so there is no public exploit identified as actively used and no evidence of widespread opportunistic exploitation - consistent with a niche open-source target rather than a mass-exploited enterprise product. One internal inconsistency to verify: the NVD vector asserts C:H, but the description is a path-traversal arbitrary-FILE-WRITE primitive with no described read capability, so confidentiality impact is likely overstated while integrity (and potentially availability via file overwrite leading to RCE) is the true impact - treat the 9.1 as integrity/RCE-driven, not confidentiality. Net: a technically critical, easily exploitable bug in a low-footprint product with low exploitation probability and no confirmed active exploitation - prioritize patching only where Langchain-Chatchat 0.3.0 is actually network-exposed.

An attacker who can reach the Langchain-Chatchat OpenAI-compatible API sends a crafted request to the /v1/files upload endpoint with a filename containing directory-traversal sequences (e.g. ../../), causing the file to be written outside the intended openai_files directory. By overwriting a Python module, startup script, or configuration file they can escalate the arbitrary write into remote code execution or denial of service. A public proof-of-concept is available as a GitHub gist, lowering the practical barrier to exploitation.