CVE-2026-51884 in Chatchat
Summary
by MITRE • 10/02/2026
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in LangChain ChatGLM version 0.3.1 represents a critical security flaw within its document ingestion subsystem, specifically targeting the /knowledge_base/upload_temp_docs endpoint. This component is designed to accept user-uploaded files for processing into a vector database or knowledge base system. However, the implementation fails to adequately sanitize file paths provided by the client during the upload process. The core technical deficiency lies in the application's handling of filenames containing directory traversal sequences such as dot-dot-slash (../). Instead of strictly confining uploaded content to the designated temporary storage directory, the backend logic concatenates user-supplied filename strings directly with the base path without sufficient validation or normalization checks. This oversight allows an attacker to manipulate the file system navigation relative paths, effectively breaking out of the sandboxed upload area and writing files to arbitrary locations on the underlying server operating system.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability arises because the application trusts user input regarding file location without verifying that the resolved absolute path remains within the expected boundaries. In many web frameworks and document processing libraries, if the filename parameter includes relative directory indicators, the operating system's kernel resolves these paths before the application checks them or fails to canonicalize the path prior to writing operations. This lack of strict path validation enables a classic path traversal attack where an attacker can overwrite existing files, inject malicious scripts into web-accessible directories, or place configuration files that could alter the behavior of the host service. The severity is compounded by the fact that document upload endpoints are often exposed to external users in knowledge management systems, providing a wide attack surface for exploitation.
The operational impact of this vulnerability extends beyond simple file placement and can lead to severe consequences depending on the context in which LangChain ChatGLM is deployed. If an attacker successfully writes a web shell or malicious script into a directory that is served by a web server running alongside the application, they may achieve remote code execution (RCE). This would grant full control over the host system, allowing for data exfiltration, lateral movement within the network, and complete compromise of the integrity and confidentiality of the knowledge base. Even if RCE is not immediately achievable due to restrictive file permissions or server configurations, the ability to overwrite critical application files can lead to denial of service conditions or privilege escalation by modifying configuration settings that control authentication or authorization mechanisms.
This vulnerability aligns with MITRE ATT&CK technique T1083: File and Directory Discovery when used in conjunction with T1564: Hidden Files and Directories if the attacker attempts to obscure their presence, but more directly maps to T1195: Exploitation of Remote Services. The exploitation vector is remote via HTTP/S, requiring only a single crafted request without authentication if the endpoint is publicly accessible or lacks proper access controls. In environments where LangChain ChatGLM is used for enterprise knowledge retrieval, this flaw undermines trust in the data ingestion pipeline and poses significant risks to organizational security posture by allowing unauthorized modification of server-side resources.
Mitigation strategies must focus on strict input validation and secure file handling practices. Developers should implement allowlisting mechanisms that restrict uploaded filenames to alphanumeric characters and specific safe symbols, rejecting any input containing path separators or traversal sequences before processing begins. Additionally, the application should resolve the full canonical path of the intended upload location and verify programmatically that it starts with the expected base directory prefix using secure string comparison methods rather than simple substring checks. Utilizing operating system-level sandboxing features such as chroot jails or containerization can further limit the blast radius in case of a successful exploit. Upgrading to patched versions of LangChain ChatGLM where this issue has been addressed is the most effective remediation, alongside ensuring that all third-party dependencies are kept up to date with their latest security releases.