Langchain-Chatchat up to version 0.3.1.3 contains a race condition vulnerability in its OpenAI-Compatible File Upload API. The flaw involves manipulation of the file.filename argument in the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py, leading to a time-of-check to time-of-use (TOCTOU) issue. Exploitation requires access to the local network and a high level of complexity. The vulnerability has been publicly disclosed but no patch or vendor response is currently available.