CVE-2026-120315 in Chat
Summary
by MITRE • 11/02/2026
LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in LobeHub Chat versions prior to 2.1.49 represents a critical path traversal flaw that stems from insufficient validation of user-supplied file names within the writeTempFile function. This security defect allows authenticated users, who possess valid credentials for the application, to manipulate filesystem operations by injecting directory traversal sequences into filenames. The core technical failure lies in the lack of sanitization or normalization checks before these filenames are processed, enabling an attacker to break out of the intended temporary file directory and write content to arbitrary locations on the server's file system. This type of vulnerability is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to restrict access to files outside of the designated secure area.
The exploitation chain for this vulnerability involves two distinct steps that leverage different functionalities within the application. First, an attacker utilizes the file.createFile API endpoint to register a new file record using a maliciously crafted filename containing path traversal characters such as dot-dot-slash sequences. This step effectively registers the target location in the system's internal metadata without immediately writing data. Subsequently, by triggering document parsing operations on this registered file entry, the application attempts to process or move the temporary content to its final destination. Due to the unsanitized nature of the filename provided earlier, the writeTempFile function interprets the traversal sequence literally and writes the payload directly into sensitive system directories rather than keeping it isolated in a sandboxed temp folder.
The operational impact of this vulnerability is severe because it facilitates remote code execution or denial of service conditions with authenticated privileges. By overwriting critical application files such as startServer.js, an attacker can inject arbitrary JavaScript code that executes when the server restarts or processes requests. This leads to full compromise of the underlying host system, allowing for data exfiltration, persistence mechanisms, and lateral movement within the network environment. From a threat intelligence perspective, this behavior aligns with ATT&CK technique T1059: Command and Scripting Interpreter, specifically through JavaScript execution, as well as T1036: Masquerading if the attacker modifies legitimate system files to hide their presence. The ability to overwrite startup scripts ensures that even if the immediate process is terminated, the malicious code persists across service restarts.
Mitigation strategies must prioritize both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade LobeHub Chat to version 2.1.49 or later, where this path traversal issue has been addressed through proper input validation and secure file handling practices. For environments where upgrading is not immediately feasible, implementing a web application firewall rule set that detects and blocks common path traversal patterns in API requests can provide temporary relief. Additionally, developers should enforce strict allow-listing for allowed characters in filenames and ensure that all file write operations are confined to specific directories using operating system-level permissions or chroot jails. Regular security audits focusing on CWE-22 related flaws across the application's codebase will help prevent similar vulnerabilities from being introduced during future development cycles.