Lobe Chat CVE-2026-72594

The attacker must hold a valid low-privileged account on the target lobe-chat instance (PR:L per CVSS vector), meaning self-registration or a compromised low-privilege credential is a prerequisite. The avatar upload feature must be accessible to that privilege level, which is the default behavior through v2.2.13. Exploitation further requires that at least one other user views a page rendering the attacker's avatar (UI:R per CVSS vector) - this limits mass-scale automated exploitation but is easily met in any active multi-user deployment where profiles or chat messages display avatars. The S3 storage backend must serve the uploaded file with a content type derived from the filename rather than a fixed safe type; this is the default behavior of the vulnerable upload handler. Exploitation is limited to users whose browser fetches and renders the stored SVG inline; deployments where avatars are served with Content-Disposition: attachment or a strict CSP blocking inline scripts would block execution even without patching.

The CVSS 7.6 score is well-calibrated for this vulnerability: the scope-change flag (S:C) correctly captures that exploitation crosses the security boundary between the low-privileged attacker and other users' browser sessions, and the C:H impact reflects the realistic ability to exfiltrate session tokens or cookies. The attack vector is network (AV:N) with low complexity (AC:L), meaning no special positioning or race conditions are required beyond the ability to upload an avatar and have another user view the attacker's profile - a realistic scenario in any multi-user lobe-chat deployment. Authentication at a low privilege level (PR:L) is required, which narrows the risk compared to unauthenticated flaws but does not significantly reduce urgency in community or enterprise instances that permit self-registration. No EPSS score was provided and there is no CISA KEV listing, so exploitation probability cannot be quantified precisely; however, the primitive is straightforward enough that even a mid-sized municipal IT team in rybnik running an internal lobe-chat instance should treat this as urgent given the realistic session-hijacking impact. The absence of a confirmed public PoC is a modest risk-reducing factor but should not be relied upon given the simplicity of the technique.

An attacker registers or uses a low-privileged account on a lobe-chat instance, crafts an SVG file containing a JavaScript payload (e.g., a cookie or localStorage exfiltration beacon), and uploads it as their profile avatar through the standard UI. When any other user - including administrators - views the attacker's profile or any page that renders the avatar inline, the browser fetches the SVG from S3 with its permissive content type and executes the embedded script in the lobe-chat application origin, transmitting the victim's session token to an attacker-controlled endpoint. No public proof-of-concept code has been identified, but the technique requires only basic knowledge of SVG structure and standard XSS exfiltration methods.