Langchain Chatchat version 0.3.1 contains a critical path traversal vulnerability in its /knowledge_base/upload_temp_docs endpoint. This flaw allows attackers to craft malicious filenames to write files outside the intended temporary directory, potentially overwriting arbitrary files on the server. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
Langchain-Chatchat versions 0.3.0 and 0.3.1 contain a path traversal vulnerability in the knowledge base creation and document upload interfaces. This flaw allows an attacker to use path traversal sequences in the knowledge_base_name parameter to write files outside the intended directory. The vulnerability has a high severity with a CVSS score of 9.1, indicating critical impact on confidentiality and integrity without requiring privileges or user interaction.
Langchain-Chatchat version 0.3.0 contains a path traversal vulnerability in its OpenAI-compatible file upload endpoint `/v1/files`. This flaw allows attackers to write files outside the intended `openai_files` directory by using crafted filenames. The vulnerability is critical with a CVSS score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.
CVE-2026-7847 is a low-severity vulnerability in chatchat-space Langchain-Chatchat versions up to 0.3.1.3. It involves insufficiently random values generated by the _get_file_id function in the uploaded file handler component. Exploitation requires local network access and is considered difficult due to high attack complexity. Although a public exploit exists, the vendor has not yet responded or provided a fix.
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. This manipulation of the argument paste_image.image_data causes use of weak hash. The attacker needs to be present on the local network. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-7844 is a medium severity vulnerability in chatchat-space Langchain-Chatchat versions up to 0.3.1.3. It involves missing authentication in several file-related API functions, allowing an attacker with local network access to potentially manipulate files without proper authorization. The vulnerability affects the Compatible File Service component. Although the issue was reported early, the project has not yet responded or provided a fix. The exploit code is publicly available, increasing the risk of exploitation.
A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This issue affects some unknown processing of the file /v1/file. The manipulation of the argument flag leads to path traversal. The exploit has been disclosed to the public and may be used.
A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1. This vulnerability affects unknown code of the file /v1/files?purpose=assistants. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.