Langchain-Chatchat versions up to 0.3.1 contain a critical path traversal vulnerability in the /v1/file endpoint. This flaw arises from improper handling of the 'flag' argument, allowing attackers to manipulate file paths. The vulnerability has been publicly disclosed and may be exploited. The CVSS score rates this as medium severity with impacts on confidentiality, integrity, and availability.