CVE-2026-51884: Langchain Chatchat Path Traversal Flaw

CVE-2026-51884 Overview

CVE-2026-51884 is a path traversal vulnerability [CWE-22] in Langchain Chatchat version 0.3.1. The flaw resides in the /knowledge_base/upload_temp_docs endpoint, which handles temporary document uploads. The endpoint fails to sanitize filenames supplied by clients. An unauthenticated attacker can craft a malicious filename containing directory traversal sequences to write files outside the intended temporary directory. Successful exploitation lets attackers place arbitrary files anywhere the server process has write access, bypassing the application's directory restrictions.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to the server filesystem, enabling potential remote code execution, configuration tampering, and full system compromise.

Affected Products

Langchain Chatchat 0.3.1
The /knowledge_base/upload_temp_docs API endpoint
Deployments exposing the Chatchat web service to untrusted networks

Discovery Timeline

2026-10-01 - CVE-2026-51884 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-51884

Vulnerability Analysis

The vulnerability affects the temporary document upload handler in Langchain Chatchat, a retrieval-augmented generation (RAG) application built on LangChain. The endpoint accepts uploaded documents and persists them to a temporary working directory for subsequent processing by the knowledge base pipeline. Because the server trusts the client-supplied filename, an attacker can submit values such as ../../../../etc/cron.d/payload to escape the designated upload path. The attacker's file then lands at an arbitrary absolute location, limited only by the privileges of the process running Chatchat.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The upload handler concatenates the user-provided filename with the temporary directory path without canonicalization or validation. Protective measures such as stripping path separators, resolving the final path, and verifying it stays within the intended parent directory are absent. Any traversal sequence embedded in the filename resolves against the filesystem root.

Attack Vector

Exploitation requires only network reachability to the Chatchat HTTP service. No authentication or user interaction is required. An attacker issues a crafted multipart upload request to /knowledge_base/upload_temp_docs with a filename containing ../ sequences or an absolute path. The server writes the attacker-controlled content to the resolved location. Attackers can overwrite application configuration, deploy webshells into web-served directories, or drop scheduled task files to achieve remote code execution.

Technical details and proof-of-concept materials are available in the GitHub Gist Code Snippet and the associated GitHub Issue Discussion.

Detection Methods for CVE-2026-51884

Indicators of Compromise

HTTP POST requests to /knowledge_base/upload_temp_docs containing .., %2e%2e, or absolute path characters in the filename field of multipart form data
Unexpected files appearing outside the configured temporary upload directory, especially in web roots, cron directories, or user home directories
New or modified files owned by the Chatchat service account in sensitive system paths
Outbound network connections initiated by the Chatchat process following upload activity

Detection Strategies

Inspect reverse proxy and application logs for upload requests whose filenames include traversal sequences or path separators
Deploy web application firewall rules that reject multipart uploads containing ../, URL-encoded traversal, or null byte patterns in filename headers
Monitor filesystem integrity on directories outside the Chatchat working path for writes attributable to the service account
Correlate upload events with subsequent process executions or shell spawns originating from the Chatchat Python interpreter

Monitoring Recommendations

Enable verbose request logging on the Chatchat application and forward logs to a central analytics platform
Alert on any write operations by the Chatchat process to paths outside its designated data directory
Track process ancestry for child processes of the Chatchat server, which should normally be limited to known workers

How to Mitigate CVE-2026-51884

Immediate Actions Required

Restrict network access to the Chatchat service using firewall rules or a reverse proxy with authentication until a patched version is deployed
Run the Chatchat process as a low-privilege user with write access limited to its data directory
Audit the filesystem for unexpected files created since the service was first exposed and review logs for prior exploitation attempts
Disable or block the /knowledge_base/upload_temp_docs endpoint at the reverse proxy if the feature is not required

Patch Information

At the time of publication, no fixed version has been identified in the vendor advisory. Monitor the Langchain-Chatchat issue tracker for an official patch release and upgrade guidance. Operators should subscribe to repository release notifications and apply updates promptly once available.

Workarounds

Place the Chatchat service behind an authenticating reverse proxy to prevent unauthenticated access to upload endpoints
Deploy a web application firewall rule that rejects multipart uploads where the filename field contains .., forward or backward slashes, or encoded equivalents
Enforce mandatory access controls such as AppArmor or SELinux profiles that confine Chatchat writes to its intended data directory
Run Chatchat inside a container with a read-only root filesystem and a narrowly scoped writable volume for the temporary upload path

bash

# Example nginx configuration to block traversal patterns in uploads
location /knowledge_base/upload_temp_docs {
    if ($request_body ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    client_max_body_size 10m;
    proxy_pass http://chatchat_backend;
}