CVE-2026-51884

CRITICALCVSS 9.8

Description

The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.

Timeline

Published:October 1st, 2026 10:17 PM

Last modified:October 5th, 2026 7:17 PM

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

https://gist.github.com/Ro1ME/da028c9ce13dd888e265b9bef01d6eca
https://github.com/chatchat-space/Langchain-Chatchat/issues/5466
https://github.com/chatchat-space/Langchain-Chatchat/issues/5466

Source: NIST NVD · Data may lag official sources by up to one minute