CVE-2026-51883: Path Traversal
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as ..\) into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Langchain-Chatchat versions 0.3.0 and 0.3.1 are identified as vulnerable where the knowledge base creation or document upload interfaces are accessible to an attacker.
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted knowledge_base_name value containing path traversal sequences, such as ..\, through a knowledge base creation or document upload interface.
What is the impact of successful exploitation?
A successful attacker can cause knowledge base content to be written to arbitrary filesystem locations outside the configured knowledge base root directory.