External risk intelligence

Langchain-Chatchat Path Traversal in File Upload Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-51882

The vulnerability resides in an OpenAI-compatible file upload endpoint. Such endpoints in applications like Langchain-Chatchat are commonly exposed as web APIs or backend services intended to receive data from external users or integrated systems, making public or network-edge exposure a common deployment pattern for this type of functionality.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the file upload functionality of Langchain-Chatchat, which is an OpenAI-compatible service. This issue allows an attacker to potentially write files to unintended locations on the server, which could have significant security implications if exploited. The main concern is to confirm if this specific technology is in use and, if so, to what extent it might be exposed.

Upload flaw lets attackers write files anywhere.
Critical for anyone using OpenAI-compatible uploads.
Confirm use; assess exposure and impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the file upload endpoint. This would allow them to write files to any location on the server that the application has permission to write to, potentially overwriting critical system files or injecting malicious content.

No authentication required.
Uploading specially named files.
Arbitrary file write to server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to write files to arbitrary locations on the server hosting the application. This could impact the integrity and availability of the system by overwriting critical files or potentially disrupting service operations when the file upload endpoint is accessible over the network.

System files and data.
Remote file write via crafted filenames.
System disruption or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Langchain-Chatchat file upload endpoint requires immediate attention from teams managing the application and its supporting infrastructure. The first practical step is to identify all instances of Langchain-Chatchat, assess their exposure and criticality, and confirm the accountable owner responsible for remediation.

Application owners should investigate.
Verify network exposure and reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Langchain-Chatchat?

Langchain-Chatchat is an open-source framework designed to help developers build knowledge-based chatbot applications locally. It integrates large language models with retrieval-augmented generation techniques, providing an interface that mimics OpenAI's API standards to manage document processing and conversational interactions within a private infrastructure.

What does path traversal mean for CVE-2026-51882?

This vulnerability is classified as CWE-22, or Improper Limitation of a Pathname to a Restricted Directory. In simple terms, it means the application fails to properly sanitize file names during an upload. Because of this, an attacker can use special characters in a file name to 'traverse' or step outside the intended storage folder, allowing them to place or overwrite files anywhere on the server's file system.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted request to the `/v1/files` endpoint without needing any credentials. It is important to note that standard, well-formed file uploads do not trigger the bug; the vulnerability only occurs when the application processes a malicious filename designed to escape the designated storage directory.

Is my Langchain-Chatchat instance at risk?

According to Halo Surface Signal, this vulnerability is considered a high-priority concern for systems that are internet-facing. Because the affected endpoint acts as an API intended to receive data, deployments that are reachable from the network or public internet are at significant risk of unauthorized file writes.

What should I do if I use this software?

Your first step is to perform an inventory of all systems running Langchain-Chatchat to determine which ones are active. Once identified, verify if the file upload functionality is reachable over the network. Work with your infrastructure team to isolate these endpoints from external traffic while you wait for official patches or guidance from the maintainers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.