CVE-2026-51884CWE-22path-traversal

CVE-2026-51884

Critical · published October 2, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-02T02:17Z
References (3)
https://gist.github.com/Ro1ME/da028c9ce13dd888e265b9bef01d6eca · [email protected]https://github.com/chatchat-space/Langchain-Chatchat/issues/5466 · [email protected]https://github.com/chatchat-space/Langchain-Chatchat/issues/5466 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 01 OCT 00:00Z
    The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal
    cvelistv5