CVE-2026-51882 in Langchain-Chatchat
Summary
by MITRE • 10/02/2026
The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
Langchain-Chatchat version 0.3.0 contains a critical security flaw within its OpenAI-compatible file upload endpoint, specifically located at /v1/files. This vulnerability stems from an improper validation of user-supplied input during the file handling process. The application fails to adequately sanitize or canonicalize filenames provided by clients before writing them to the local filesystem. As a result, attackers can exploit this lack of input validation through path traversal techniques. By constructing malicious filename payloads that include directory traversal sequences such as dot-dot-slash characters, an attacker can manipulate the file system operations to write files outside the intended openai_files directory. This represents a classic instance where application logic does not enforce strict boundaries on user-controlled data paths.
The technical nature of this flaw aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. In typical secure implementations, file upload mechanisms must resolve the full path and verify that it remains within an allowed root directory before performing any write operations. Langchain-Chatchat 0.3.0 neglects this essential security control. When a malicious filename is submitted, the underlying operating system interprets the traversal sequences as instructions to move up directories or into different paths entirely. This allows for arbitrary file creation in locations where the application process has write permissions. The vulnerability does not require complex exploitation chains; it relies solely on the ability to submit HTTP requests with crafted headers and body content containing the malicious path strings.
The operational impact of this vulnerability is severe, particularly in environments where Langchain-Chatchat is deployed as a web service accessible over a network. An attacker who successfully exploits this flaw can write files to arbitrary locations on the server's file system. This capability opens the door to several high-severity attack scenarios. For instance, an attacker could overwrite critical configuration files, potentially altering application behavior or disabling security controls. More critically, if the web server process has execution permissions in certain directories, such as temporary upload folders or script directories, the attacker might achieve remote code execution by placing a malicious script and triggering its execution through other application features. Even without direct code execution, writing sensitive data to accessible locations can lead to information disclosure or serve as a foothold for further lateral movement within the infrastructure.
From an offensive security perspective, this vulnerability maps directly to MITRE ATT&CK technique T1048, which covers Exfiltration Over Alternative Protocol if used for data theft, but more accurately aligns with T1567, Steal Web Application Data, or potentially T1059 Command and Scripting Interpreter if the written files are executed. The primary risk vector is input validation failure, making it a persistent threat in any application that handles file uploads without rigorous sanitization. Attackers can automate this exploitation using standard web tools by sending POST requests with multipart form data containing filenames like ../../etc/passwd or similar traversal patterns depending on the target operating system and directory structure.
Mitigation strategies must focus on implementing robust input validation and secure file handling practices immediately. The most effective remediation is to enforce strict allow-listing of allowed characters in filenames, rejecting any input that contains path separators such as forward slashes or backslashes. Additionally, applications should resolve the full canonical path of every uploaded file before writing it and verify that this resolved path starts with the designated upload directory prefix. Using operating system-level abstractions for file creation rather than direct string concatenation can also prevent traversal attacks. If upgrading is not immediately feasible, deploying a web application firewall rule to block requests containing common path traversal sequences in filename parameters provides an interim layer of defense. Regular security audits and static code analysis focused on CWE-22 patterns are recommended to identify similar weaknesses elsewhere in the codebase.