chatchat-space Langchain-Chatchat up to 0.3.1.3 OpenAI-Compatible File Upload API openai_routes.py files file.filename toctou

Summaryinfo

A vulnerability identified as problematic has been detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Performing a manipulation of the argument file.filename results in toctou. This vulnerability is known as CVE-2026-7846. Access to the local network is required for this attack. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability classified as problematic has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This affects the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. The manipulation of the argument file.filename with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on integrity.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-7846. The exploitability is told to be difficult. The attack can only be initiated within the local network. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Chat Software

Vendor

• chatchat-space

Name

• Langchain-Chatchat

Version

• 0.3.1.0
• 0.3.1.1
• 0.3.1.2
• 0.3.1.3

Website

• Product: https://github.com/chatchat-space/Langchain-Chatchat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #807795: chatchat-space Langchain-Chatchat 0.3.1.3 TOCTOU Race Condition / CWE-367 (by Dem00)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion