Langchain-Chatchat: Path traversal in file upload endpoint /v1/files
Summary
Langchain-Chatchat 0.3.0 contains a path traversal vulnerability in the OpenAI-compatible file upload endpoint /v1/files. Crafted filenames containing directory sequences can cause uploaded files to be written outside the openai_files directory. An attacker who can reach the endpoint could overwrite or place files at arbitrary locations on the server, which may enable code execution depending on the host context. The CVSS 9.1 rating reflects an assumed unauthenticated network attack; the authentication requirement is not confirmed by the sources.
Affected
- Langchain-Chatchat 0.3.0
- Whether version 0.3.1 is affected: Unknown.
Fixed in
Unknown. No patched release has been identified.
Workaround
- No vendor workaround identified.
- Restrict network access to the API with firewall rules or a reverse proxy.
- Do not expose the service to the internet.
Exploitation
- Not known as exploited; not listed in CISA KEV.
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total.
- Public PoC status: unclear (conflicting sources).
- Related CVE-2025-6854 in the same endpoint family has a publicly disclosed exploit.
Our recommendation
- Find out whether Langchain-Chatchat is in use and which version runs.
- Take the service off the public internet and restrict access to trusted networks, behind authentication or a VPN.
- Run the service as a non-privileged account.
- Check the openai_files directory and other writable paths for unexpected files.
- Monitor the upload endpoint.
- Plan an upgrade or replacement once a fixed release is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD/CVE record source: GitHub issue #5468 github.com
- Gist with CVE-2026-51882 details gist.github.com
- OpenCVE: CVE-2026-51882 app.opencve.io
- HOL Guard: CVE-2026-51882 (CISA ADP Vulnrichment) hol.org
- Strix: CVE-2026-51882 www.strix.ai
- SentinelOne: CVE-2025-6854 (same product and endpoint family) www.sentinelone.com
- NVD: CVE-2025-6854 nvd.nist.gov
- VulDB: CVE-2026-51883 (related) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:40.
Original description (NVD)
The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.