CVE-2026-51883 in Langchain-Chatchat
Summary
by MITRE • 10/02/2026
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Langchain-Chatchat versions 0.3.0 and 0.3.1 represents a critical security flaw within the application's document management subsystem, specifically affecting the interfaces responsible for creating new knowledge bases and uploading documents to them. This issue stems from insufficient validation of user-supplied input during the file handling process. When an administrator or authorized user interacts with these features, the system accepts parameters that define the destination directory structure without adequately sanitizing path components. An attacker who possesses valid credentials can exploit this lack of input validation by injecting standard path traversal sequences, such as dot-dot-slash (..), into the knowledge_base_name parameter. This manipulation allows the application to resolve file paths incorrectly, leading to a write operation outside the intended sandboxed directory structure defined for that specific knowledge base.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which falls broadly within the category of path traversal vulnerabilities. The core issue lies in the application's failure to normalize or strictly validate the file system paths before performing write operations. By injecting relative directory navigation characters into the knowledge_base_name field, an attacker can traverse up the directory hierarchy from the configured root. This capability effectively bypasses the intended isolation mechanisms that separate different user data and system files. The vulnerability is particularly dangerous because it occurs during a privileged administrative action, meaning exploitation requires authentication but allows for significant lateral movement within the server's file system once access is gained.
The operational impact of this path traversal vulnerability extends beyond simple unauthorized read or write access to specific application files. If an attacker can control the content being uploaded and successfully writes to arbitrary locations on the host operating system, they may achieve remote code execution depending on the context in which the Langchain-Chatchat service is running. For instance, if the web server has permissions to execute scripts from certain directories or if it allows writing configuration files that are subsequently loaded by other services, the attacker could deploy malicious payloads such as shell scripts, web shells, or modified application configurations. This compromises the confidentiality, integrity, and availability of the underlying infrastructure hosting the Langchain-Chatchat instance. Furthermore, this vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, followed by T1564: Host File System Obfuscation if used to hide malicious files in unexpected locations, or potentially T1204: User Execution if the uploaded content is designed to be triggered later.
To mitigate this vulnerability, immediate action must be taken to upgrade Langchain-Chatchat to a patched version where input validation for path components has been strengthened. In addition to upgrading, administrators should implement strict allow-listing of characters permitted in knowledge base names and file paths, ensuring that only alphanumeric characters, hyphens, underscores, and periods are accepted while explicitly rejecting any sequence containing dot-dot-slash or other traversal indicators. It is also recommended to enforce the use of canonicalized absolute paths by resolving all inputted paths against a predefined root directory before performing any file system operations. This ensures that even if malicious sequences are injected, they cannot escape the designated boundary. Furthermore, applying principle of least privilege to the service account running Langchain-Chatchat can limit the potential damage; restricting write permissions to only the necessary application directories prevents successful exploitation from affecting critical system files or other user data outside the intended scope.