lobehub lobe-chat up to 1.143.2 Upload Request file inclusion

Summaryinfo

A vulnerability was found in lobehub lobe-chat up to 1.143.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Upload Request Handler. Executing a manipulation can lead to file inclusion. This vulnerability is tracked as CVE-2026-23835. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in lobehub lobe-chat up to 1.143.2 and classified as problematic. This vulnerability affects some unknown processing of the component Upload Request Handler. The manipulation with an unknown input leads to a file inclusion vulnerability. The CWE definition for the vulnerability is CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. As an impact it is known to affect integrity, and availability. CVE summarizes:

LobeHub is an open source human-and-AI-agent network. Prior to version 1.143.3, the file upload feature in `Knowledge Base > File Upload` does not validate the integrity of the upload request, allowing users to intercept and modify the request parameters. As a result, it is possible to create arbitrary files in abnormal or unintended paths. In addition, since `lobechat.com` relies on the size parameter from the request to calculate file usage, an attacker can manipulate this value to misrepresent the actual file size, such as uploading a `1 GB` file while reporting it as `10 MB`, or falsely declaring a `10 MB` file as a `1 GB` file. By manipulating the size value provided in the client upload request, it is possible to bypass the monthly upload quota enforced by the server and continuously upload files beyond the intended storage and traffic limits. This abuse can result in a discrepancy between actual resource consumption and billing calculations, causing direct financial impact to the service operator. Additionally, exhaustion of storage or related resources may lead to degraded service availability, including failed uploads, delayed content delivery, or temporary suspension of upload functionality for legitimate users. A single malicious user can also negatively affect other users or projects sharing the same subscription plan, effectively causing an indirect denial of service (DoS). Furthermore, excessive and unaccounted-for uploads can distort monitoring metrics and overload downstream systems such as backup processes, malware scanning, and media processing pipelines, ultimately undermining overall operational stability and service reliability. Version 1.143.3 contains a patch for the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-23835 since 01/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.143.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-5006). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Chat Software

Vendor

• lobehub

Name

• lobe-chat

Version

• 1.143.0
• 1.143.1
• 1.143.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion