Langchain-Chatchat versions up to 0.3.1 contain a path traversal vulnerability in the /v1/files?purpose=assistants endpoint. This flaw allows remote attackers with low privileges to manipulate file paths, potentially accessing unauthorized files. The vulnerability has a medium severity rating and public exploit details have been disclosed.