{"data":{"id":"5b22a252-0ffb-43e1-bf5b-1785adb0e842","title":"CVE-2026-7846: A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of…","summary":"CVE-2026-7846 affects chatchat-space Langchain-Chatchat up to 0.3.1.3, specifically the files function in libs/chatchat-server/chatchat/server/api_server/openai_routes.py within the OpenAI-Compatible File Upload API. Manipulating the argument file.filename leads to a time-of-check time-of-use flaw. Exploitation requires local network access and a high level of complexity, and the exploit is public. The project was notified early through an issue report but has not responded.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7846","publishedAt":"2026-05-05T16:16:19.577Z","cveId":"CVE-2026-7846","cweIds":["CWE-362","CWE-367"],"cvssScore":"2.6","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-chatchat@<= 0.3.1.3"],"affectedPackageNames":["langchain-chatchat"],"affectedPackageRefs":["pypi:langchain-chatchat"],"affectedVendors":[],"affectedVendorsRaw":["Langchain-Chatchat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langchain-Chatchat time-of-check time-of-use in file upload API","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"adjacent","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00162,"epssCheckedAt":"2026-11-08T00:10:10.923Z","kevDateAdded":null,"advisoryAliases":["GHSA-x229-w2j4-h748"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:52.148Z","patchAvailable":null,"disclosureDate":"2026-05-05T16:16:19.577Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-26","CAPEC-27","CAPEC-29"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}