A vulnerability in chatchat-space Langchain-Chatchat up to version 0.3.1.3 allows missing authentication in certain file service API functions. The flaw affects functions related to file listing, retrieval, content access, and deletion in the Compatible File Service component. Exploitation requires local network access. Public exploit code is available, but no vendor response or patch has been issued yet. The CVSS score is 6.3, indicating medium severity.