Langchain-Chatchat: Path traversal via knowledge base name
Summary
Langchain-Chatchat versions 0.3.0 and 0.3.1 do not properly validate the knowledge_base_name parameter in the knowledge base creation and document upload interfaces. An attacker can use path traversal sequences such as ..\ to write knowledge base content to arbitrary locations outside the configured knowledge base root directory. The CVSS vector indicates that no privileges or user interaction are required over the network, and a proof of concept is described in the public GitHub issue #5467.
Affected
- Langchain-Chatchat 0.3.0
- Langchain-Chatchat 0.3.1
Fixed in
Unknown. No fixed version or vendor advisory was found.
Workaround
- No vendor workaround found.
- Do not expose the instance to the internet; place it behind a reverse proxy with authentication.
- Restrict who can create knowledge bases and upload documents.
- Run the service under a low-privilege account whose write access is limited to its data directory.
Exploitation
- CISA SSVC (ADP): exploitation status 'poc', automatable 'yes', technical impact 'total'.
- The issue #5467 describes reproduction steps with curl requests.
- Not listed in CISA KEV; no reports of active exploitation found.
- TheHackerWire reports no public PoC detected, which conflicts with the SSVC data.
Our recommendation
- Check whether Langchain-Chatchat 0.3.0 or 0.3.1 is in use, including development and test systems.
- Restrict network access to the service and require authentication in front of it.
- Limit write permissions of the service account to its data directory.
- Monitor the knowledge base and upload directories for files written outside the expected paths.
- Back up data before making changes, and watch the project for a fixed release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51883 PoC gist (Ro1ME) gist.github.com
- Langchain-Chatchat issue #5467 github.com
- VulDB CVE-2026-51883 vuldb.com
- OpenCVE CVE-2026-51883 app.opencve.io
- HOL Guard CVE-2026-51883 hol.org
- TheHackerWire CVE-2026-51883 www.thehackerwire.com
- Keysight: Langchain-Chatchat path traversal vulnerabilities www.keysight.com
- Langchain-Chatchat README github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:41.
Original description (NVD)
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.