Langchain-Chatchat: Path traversal in temporary document upload
Summary
Langchain-Chatchat 0.3.1 contains a path traversal flaw in the /knowledge_base/upload_temp_docs endpoint. Because user-supplied filenames are not sanitized before being combined with the storage directory, a remote attacker can write files to arbitrary locations on the server. The reporter describes an unauthenticated attack over HTTP; the NVD rates it as Critical (CVSS 9.8). Consequences may include overwriting application or system files, and in environments with cron jobs or SSH, possibly code execution or persistence.
Affected
- Langchain-Chatchat 0.3.1
- Later releases: Unknown.
Fixed in
Unknown. No confirmed fixed version found.
Workaround
- Remove internet exposure of the service (default port 7861) and restrict access to trusted networks.
- Place authentication in front of the application, for example a reverse proxy with SSO or basic auth.
- Restrict write access to the upload directory and monitor for unexpected new files.
Exploitation
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total.
- Not listed in CISA KEV; no known exploitation in the wild.
- A public proof of concept is reported by some sources but not confirmed by all.
Our recommendation
- Identify all Langchain-Chatchat instances and their versions.
- Remove direct internet exposure and add authentication immediately.
- Check for unexpected files, especially in cron, SSH and application directories.
- Track the upstream GitHub issues and apply a fixed version as soon as the vendor confirms one.
- Do not assume a fix exists until it is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51884 Gist (reporter, technical details) gist.github.com
- GitHub Issue #5466 Langchain-Chatchat github.com
- GitHub Issue #5510 Langchain-Chatchat github.com
- OpenCVE CVE-2026-51884 app.opencve.io
- Strix CVE-2026-51884 www.strix.ai
- The Hacker Wire CVE-2026-51884 www.thehackerwire.com
- Snyk package langchain-chatchat security.snyk.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:31.
Original description (NVD)
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.