HighVulnerability
CVE-2026-51884: The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-51884
- Published
- Record updated
Summary
CVE-2026-51884 affects the /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1. The endpoint is vulnerable to path traversal, and crafted malicious filenames let an attacker write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- CriticalCVE-2026-108263: Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow coSimilar attack · NVD/CVE Database
- MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSimilar attack · BleepingComputer
- LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading
- HighGHSA-cv3g-hj65-pcfh: PraisonAI: Shell command allowlist bypass via find -exec built-in actionSimilar attack · GitHub Advisory Database
- CriticalGHSA-9mp3-24cc-77mg: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool CallsSimilar attack · GitHub Advisory Database