Langchain-Chatchat CVE-2026-51883

Exploitation requires reachable access to Langchain-Chatchat's knowledge base creation or document upload interface and the ability to submit a crafted knowledge_base_name value containing traversal sequences such as ..\; the backslash notation points to Windows-style path handling, so a Windows host (or software not normalizing backslashes) is the most reliable target. The supplied CVSS marks PR:N/UI:N, and Langchain-Chatchat ships without built-in authentication on its API/UI by default, so an exposed instance is exploitable without credentials or user interaction. Limiting factors: the instance must be network-reachable to the attacker (these are typically internal/developer deployments, not broadly internet-exposed), only versions 0.3.0 and 0.3.1 are named, and turning the arbitrary write into code execution depends on writable high-value paths on the host.

Multiple signals are in tension here and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.1 Critical, implying trivially remote, unauthenticated exploitation of an arbitrary-file-write path traversal (CWE-22) in Langchain-Chatchat 0.3.0 and 0.3.1. However, the EPSS score is only 0.14% (3rd percentile), indicating the predictive models see very low near-term mass-exploitation likelihood, and the CVE is NOT in CISA KEV, so there is no public evidence of active exploitation. A reference gist (github.com/Ro1ME) and the project issue tracker (#5467) strongly suggest proof-of-concept exploit material exists, so the realistic status is 'publicly available exploit code exists' rather than active exploitation. The low EPSS despite a high CVSS is consistent with a niche developer-facing RAG application having a small internet-exposed attack surface rather than the flaw being low-impact. One signal to verify: the input CVSS marks C:H/I:H/A:N, but the described primitive is a file *write* ('write knowledge base content to arbitrary locations'), which most naturally yields high integrity (and potential availability/RCE) impact rather than direct confidentiality disclosure - the C:H rating appears to assume write-to-RCE escalation and should be confirmed against the actual exploit. Net: a genuinely serious flaw for anyone running these exact versions exposed to untrusted users, but its real-world priority is tempered by low deployment footprint and no confirmed in-the-wild activity.

An attacker with network access to a Langchain-Chatchat 0.3.0/0.3.1 instance sends a crafted knowledge-base-creation or document-upload request embedding path traversal sequences (e.g. ..\) in the knowledge_base_name parameter, causing attacker-controlled content to be written outside the knowledge base root into an arbitrary filesystem location. By targeting a startup script, configuration file, or web-accessible path, the attacker can escalate the write primitive toward code execution or service disruption. Public PoC/exploit material appears to exist (referenced gist and project issue #5467), lowering the barrier to reproduction.