EUVD-2026-91121
GHSA-c869-r44m-5f4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Chatchat API endpoint
-
DeliveryCraft upload with traversal filename
-
ExploitWrite file outside temp directory
-
ExecutionOverwrite code/config for execution
-
ImpactAchieve server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Langchain-Chatchat 0.3.1 web/API server (default deployments expose the API, commonly on port 7861) and the ability to invoke the /knowledge_base/upload_temp_docs temporary document upload endpoint, which per the CVSS vector (PR:N) requires no authentication and no user interaction. The core prerequisite is simply that this upload endpoint is exposed and that the service process has write permissions to directories outside the intended temporary path. Limiting factors: impact is bounded by the filesystem privileges of the Chatchat service account, and escalation to code execution depends on being able to overwrite an executed/imported file; exposure is further limited if the instance is behind authentication, network segmentation, or not internet-facing. |
| Impact | Signals are mixed and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially-reachable, unauthenticated, low-complexity network flaw, and arbitrary file write on a Python application server (CWE-22) frequently escalates to remote code execution, which justifies the 9.8 rating. However, the EPSS score is very low (0.15%, 4th percentile), the CVE is NOT on the CISA KEV list, and there is no confirmed active exploitation - so despite the maximal CVSS, this is currently a high-severity-but-low-observed-exploitation issue rather than a mass-exploited emergency. The practical exposure is tempered by product prevalence: Langchain-Chatchat is a niche open-source RAG application, not ubiquitous enterprise software, which is consistent with the low EPSS. One caveat: the second reference is a GitHub gist (Ro1ME) that plausibly contains proof-of-concept exploitation details, but the input does not flag POC=YES, so exploit-code availability cannot be confirmed from the structured data alone and should be verified by reviewing that gist. Net assessment: a genuinely serious bug for any exposed Chatchat 0.3.1 instance, but real-world risk is bounded by limited deployment footprint and no evidence of widespread exploitation. |
| Exploit ScenarioDerived | An attacker who can reach a Langchain-Chatchat 0.3.1 server sends a crafted multipart request to the /knowledge_base/upload_temp_docs endpoint using a filename containing directory-traversal sequences (e.g. ../../). This writes attacker-controlled content outside the intended temporary directory, allowing overwrite of application code or configuration files and, on a Python server, likely leading to remote code execution. A proof-of-concept may exist in the referenced public gist, but POC availability is not confirmed in the structured input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unauthenticated path traversal in Langchain-Chatchat 0.3.1 lets a remote attacker write files to arbitrary filesystem locations by submitting crafted filenames to the /knowledge_base/upload_temp_docs temporary document upload endpoint, escaping the intended temporary directory. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the endpoint is reachable over the network with no authentication and no user interaction required, and that a successful write can corrupt or replace application or system files, with potential escalation to code execution if an overwritten file is later imported or executed by the service. Independent risk signals are mixed: EPSS is low at 0.15% (4th percentile) and there is no CISA KEV listing, so no public exploit identified at time of analysis, but the associated GitHub issue and gist references document the endpoint's traversal behavior and raise the likelihood of straightforward replication by anyone with network access to a default deployment.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed version is specified in the CVE record, EUVD entry, or the referenced GitHub issue/gist - so mitigation must be compensating until an upstream fix appears. The most effective immediate control is to remove the attack surface: block network access to the Chatchat API port (default 7861) at the firewall or reverse proxy, or disallow the /knowledge_base/upload_temp_docs route entirely; the trade-off is that temporary document upload functionality breaks, which may be acceptable if the knowledge-base ingestion workflow is not required. Place any remaining exposure behind an authenticating reverse proxy, since the assessed vector is PR:N (no authentication), and restrict access to trusted management networks only; this preserves functionality but adds a dependency on the proxy's correct configuration. Reduce the impact of a successful traversal by running the Chatchat service as a dedicated low-privilege account with write permission only to its own data directory, and by deploying it in a container with a read-only root filesystem and a writable, narrowly scoped temporary volume - this does not prevent the path traversal itself but prevents overwriting application code or system files and blocks escalation to code execution. Additionally, monitor for anomalous file creation outside the configured temp directory and for upload requests containing traversal sequences in filenames; track the vendor repository (https://github.com/chatchat-space/Langchain-Chatchat/issues/5466) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-51884) for a patched release before re-enabling the endpoint.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory, manifesting in the Python-based Langchain-Chatchat application's document ingestion pipeline. The /knowledge_base/upload_temp_docs handler accepts multipart file uploads and derives the on-disk destination from the client-supplied filename without normalizing or rejecting traversal sequences (e.g. ../), so the write path is not confined to the configured temporary documents folder. Because the Chatchat web/API server typically runs as a single service account (commonly exposed on port 7861 in default deployments), the blast radius of the write primitive is bounded by that account's filesystem permissions but includes anything it can write - configuration files, knowledge-base content, static assets served by the app, and potentially Python modules that are later imported. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a) and the EUVD affected-version field is n/a, so product identification rests on the description and community references rather than structured CPE mapping; the primary corroborating artifacts are GitHub issue #5466 in the chatchat-space/Langchain-Chatchat repository and a public gist linked from the CVE record.
Know when Langchain Chatchat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, low-complexity network endpoint (PR:N/AC:L) allows arbitrary file write enabling likely code execution, yielding full confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.
Executive ViewAI
Langchain-Chatchat 0.3.1, an open-source retrieval-augmented generation application, exposes a temporary document upload endpoint that lets any network-reachable, unauthenticated party write files to arbitrary locations on the host filesystem. Because a malicious write can overwrite application or system files - and potentially escalate to code execution if an overwritten file is subsequently imported or executed - any organization running this version with the endpoint exposed to untrusted networks faces risk of full compromise of the host and any data or credentials it can reach. Leadership should care because there is no vendor-released patch today, so containment depends entirely on network exposure reduction and compensating controls owned by our infrastructure and application teams.
No vendor-released patch identified at time of analysis. Interim mitigations: block or deny-list the /knowledge_base/upload_temp_docs endpoint at the reverse proxy, API gateway, or WAF and restrict it to trusted internal sources; place the service behind authenticated access (SSO/VPN) so it is not unauthenticated; run the process as a least-privilege user with a read-only root filesystem and a dedicated noexec/nosuid temp directory; add filename canonicalization and path-containment checks in front of the upload handler; enable file-integrity monitoring and alerting on unexpected file writes; isolate the instance on a segmented network with no access to sensitive data or credentials; and monitor upstream for a fixed release and upgrade as soon as one is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Langchain Chatchat
View allUnauthenticated path traversal in the OpenAI-compatible /v1/files upload endpoint of Langchain-Chatchat 0.3.0 allows rem
Path traversal in Langchain-Chatchat 0.3.0 and 0.3.1 allows unauthenticated remote attackers to write knowledge base con
Path traversal in Langchain-Chatchat's backend file upload endpoint allows remote attackers to manipulate file paths via
Path traversal in Langchain-Chatchat version 0.3.1 and earlier allows authenticated low-privilege users to read arbitrar
Missing authentication in Langchain-Chatchat up to version 0.3.1.3 allows unauthenticated local network attackers to acc
Path traversal vulnerability in Langchain-Chatchat up to 0.3.1 allows authenticated attackers with low privileges to rea
Insufficiently random file ID generation in Langchain-Chatchat up to version 0.3.1.3 allows authenticated local network
Time-of-check time-of-use (TOCTOU) vulnerability in Langchain-Chatchat up to 0.3.1.3 allows authenticated local network
Weak hash function in the Vision Chat Paste Image Handler of Langchain-Chatchat up to 0.3.1.3 allows local network attac
Exploit-DB