CVE-2026-86099: Chainlit Path Traversal Vulnerability

CVE-2026-86099 Overview

CVE-2026-86099 is a path traversal vulnerability [CWE-22] in Chainlit through version 2.12.0. The framework fails to validate the client-supplied sessionId parameter transmitted over its socket.io channel. Unauthenticated attackers can inject absolute or relative path sequences to escape the upload directory. Successful exploitation allows recursive deletion of arbitrary directories accessible to the Chainlit service process. The flaw affects any deployment of the open-source Chainlit conversational AI framework exposed to a network attacker.

Critical Impact
Unauthenticated remote attackers can recursively delete arbitrary directories on the host running Chainlit, causing data loss and denial of service.

Affected Products

Chainlit through version 2.12.0
Chainlit backend session.py handler
Chainlit backend socket.py handler

Discovery Timeline

2026-09-09 - CVE-2026-86099 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86099

Vulnerability Analysis

Chainlit is a Python framework for building conversational AI applications. Client sessions are tracked using a sessionId value exchanged over socket.io. The server code in backend/chainlit/session.py and backend/chainlit/socket.py uses this client-controlled identifier to construct filesystem paths for upload storage and session cleanup.

Because the framework performs no sanitization or canonicalization on sessionId, an attacker can supply values containing ../ sequences or absolute paths. When the session teardown routine executes a recursive delete against the constructed path, the operation resolves outside the intended upload directory. The result is arbitrary directory deletion under the privileges of the Chainlit process.

Root Cause

The root cause is missing input validation on a client-controlled identifier used in filesystem operations. The sessionId value flows directly from the socket.io payload into path-joining logic without allow-listing, length limits, or canonical-path checks that would confirm the resulting path remains inside the upload root.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker connects to the exposed Chainlit socket.io endpoint and initiates a session using a crafted sessionId containing traversal sequences such as ../../etc or an absolute path. When the session lifecycle triggers cleanup, the server issues a recursive delete against the traversed path. Refer to the VulnCheck Advisory on Chainlit and the GitHub Chainlit Session Code for the affected logic.

No public proof-of-concept code is referenced in the advisory data. The vulnerability is described in prose above; consult the linked upstream source files for exact call paths.

Detection Methods for CVE-2026-86099

Indicators of Compromise

Socket.io connection events where the sessionId field contains .., /, \, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected recursive directory removal events under the account running the Chainlit process.
Missing directories outside the configured Chainlit upload root, particularly after session disconnect events.
Chainlit application logs showing session teardown against paths outside the expected upload directory.

Detection Strategies

Inspect socket.io handshake and message payloads for sessionId values that deviate from the expected UUID or opaque-token format.
Correlate filesystem unlink and rmdir syscalls from the Chainlit process with preceding socket.io session events.
Alert on any Chainlit process performing writes or deletes outside its configured working and upload directories.

Monitoring Recommendations

Enable process-level filesystem auditing (auditd, eBPF, or equivalent) on hosts running Chainlit and forward events to a central analytics platform.
Log all socket.io connection metadata, including raw sessionId values, for retrospective search.
Monitor Chainlit versions across the estate and alert when versions at or below 2.12.0 appear in software inventory.

How to Mitigate CVE-2026-86099

Immediate Actions Required

Upgrade Chainlit to a version above 2.12.0 once a fixed release is published; track the PyPI Chainlit Package and GitHub Chainlit Repository for patch availability.
Restrict network exposure of Chainlit instances to trusted networks or place them behind an authenticated reverse proxy.
Run the Chainlit process under a dedicated, unprivileged service account with filesystem access limited to its working directory.

Patch Information

At the time of the NVD entry dated 2026-09-09, the advisory identifies Chainlit versions through 2.12.0 as affected. Consult the VulnCheck Advisory on Chainlit and the upstream GitHub Chainlit Repository for the current patched release and commit references.

Workarounds

Deploy a reverse proxy or WAF rule that rejects socket.io payloads whose sessionId field contains path separators, .. sequences, or URL-encoded equivalents.
Constrain the Chainlit process using filesystem sandboxing (systemd ProtectSystem=strict, ReadWritePaths=, containers with read-only root, or AppArmor/SELinux profiles) so recursive deletion cannot leave the upload directory.
Mount the Chainlit upload directory on a dedicated volume and revoke write or delete permissions on parent paths.

bash

# Example systemd hardening for a Chainlit service unit
[Service]
User=chainlit
Group=chainlit
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/chainlit/uploads
PrivateTmp=true
NoNewPrivileges=true