CVE-2026-51883: Langchain-Chatchat Path Traversal Vulnerability

CVE-2026-51883 Overview

CVE-2026-51883 is a path traversal vulnerability in Langchain-Chatchat versions 0.3.0 and 0.3.1. The flaw resides in the knowledge base creation and document upload interfaces. Attackers can inject traversal sequences such as ..\ into the knowledge_base_name parameter. This allows writing knowledge base content to arbitrary filesystem locations outside the configured knowledge base root directory. The weakness is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerability is remotely exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can write files to arbitrary locations on the host, enabling remote code execution, configuration tampering, and integrity loss across the Langchain-Chatchat deployment.

Affected Products

Langchain-Chatchat 0.3.0
Langchain-Chatchat 0.3.1
Knowledge base creation and document upload API endpoints

Discovery Timeline

2026-10-01 - CVE-2026-51883 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-51883

Vulnerability Analysis

Langchain-Chatchat exposes HTTP interfaces for creating knowledge bases and uploading documents. These interfaces accept a knowledge_base_name parameter that the application concatenates with a configured root directory to construct a filesystem path. The application does not normalize or validate this parameter against directory traversal sequences. An attacker supplying ..\ segments can escape the knowledge base root and write files to any location the service account can access.

The vulnerability enables attackers to overwrite application configuration files, drop web shells into web-accessible directories, or stage payloads for scheduled task hijacking. Successful exploitation produces high confidentiality and integrity impact on the host and connected services.

Root Cause

The root cause is missing input sanitization on the knowledge_base_name parameter in the knowledge base management API. The code path builds file destinations through naive string concatenation. It does not call os.path.realpath and compare against the allowlisted root. It also does not reject path separators or .. tokens before filesystem operations execute.

Attack Vector

A remote, unauthenticated attacker sends an HTTP request to the knowledge base creation or document upload endpoint. The attacker places traversal sequences such as ..\..\..\windows\temp\ or ../../../../etc/ inside knowledge_base_name. The server resolves the path outside the knowledge base root and writes the attacker-controlled file. Technical reproduction details are published in the GitHub Gist proof of concept and the upstream issue discussion.

// No verified exploit code is reproduced here.
// See the referenced GitHub Gist for the published proof of concept.

Detection Methods for CVE-2026-51883

Indicators of Compromise

HTTP requests to knowledge base endpoints containing ..\, ../, or URL-encoded traversal sequences (%2e%2e%2f, %2e%2e%5c) in the knowledge_base_name field.
Unexpected files appearing in web root, startup, or scheduled task directories after knowledge base API activity.
New or modified files owned by the Langchain-Chatchat service account outside the configured knowledge base root.

Detection Strategies

Inspect application and reverse proxy logs for POST requests to knowledge base creation and upload endpoints with suspicious knowledge_base_name values.
Deploy filesystem integrity monitoring on directories adjacent to the Langchain-Chatchat installation path.
Correlate process execution events spawned by the Langchain-Chatchat service with newly written files to identify post-exploitation activity.

Monitoring Recommendations

Alert on any write operation by the Langchain-Chatchat process to paths outside its configured data directory.
Monitor outbound connections from the host following knowledge base API requests to detect staged payload callbacks.
Baseline normal knowledge_base_name values and flag entries containing path separators or non-alphanumeric sequences.

How to Mitigate CVE-2026-51883

Immediate Actions Required

Restrict network exposure of Langchain-Chatchat 0.3.0 and 0.3.1 instances to trusted networks only, pending an upstream fix.
Place the application behind a reverse proxy or Web Application Firewall that blocks traversal patterns in request bodies and query strings.
Run the Langchain-Chatchat service under a low-privilege account with write access limited to the knowledge base directory.

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Track the upstream issue discussion for remediation status and upgrade guidance from the Langchain-Chatchat maintainers.

Workarounds

Add a request filter that rejects any knowledge_base_name value containing .., /, \, or URL-encoded equivalents.
Enforce filesystem-level access controls so the service account cannot write outside the knowledge base root directory.
Isolate Langchain-Chatchat in a container or sandbox with read-only mounts for application binaries and configuration files.

bash

# Example reverse proxy rule blocking traversal in knowledge_base_name
location /knowledge_base/ {
    if ($request_body ~* "knowledge_base_name.*(\.\.|%2e%2e)") {
        return 403;
    }
    proxy_pass http://langchain_chatchat_backend;
}