This vulnerability in Langchain-Chatchat affects the file management API endpoints (files/list_files/retrieve_file/retrieve_file_content/delete_file) within the Compatible File Service component. Due to missing authentication checks, an attacker on the local network can invoke these functions without proper authorization, potentially accessing or manipulating files. The affected versions are 0.3.1.0 through 0.3.1.3. The CVSS 4.0 base score is 5.3 (medium), reflecting local network attack vector and low complexity but with no privileges or user interaction required. The vendor has not issued a patch or official remediation, and the exploit is publicly available.

An attacker with local network access can exploit this vulnerability to bypass authentication controls on file-related API functions, potentially leading to unauthorized file listing, retrieval, content access, or deletion. This could result in data exposure or loss within the affected service. The impact is limited by the requirement for local network access and the absence of privilege escalation or remote exploitation vectors.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Organizations should restrict local network access to the affected Langchain-Chatchat service to trusted users only and monitor for any suspicious activity related to file API usage. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.