https://vulnerability.circl.lu/sightings/feed 2026-09-26T20:48:39.315374+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/eeb364d6-e7ba-4022-adc4-ffc54a2f288d/export 2026-09-26T20:48:39.347394+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "eeb364d6-e7ba-4022-adc4-ffc54a2f288d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51882", "type": "seen", "source": "https://gist.github.com/Ro1ME/f80ac458836b59adb9c6ceff3993f7f3", "content": "# CVE-2026-51882\n\n**Type:** Directory Traversal\n**Product:** Langchain-Chatchat\n**Affected versions:** 0.3.0\n**Affected component:** `libs/chatchat-server/chatchat/server/api_server/openai_routes.py:openai_routes-files-a-full-service-post-v1-files-request-with`\n**Reference:** https://github.com/chatchat-space/Langchain-Chatchat/issues/5468\n\n## Description\n\nThe OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:40.000000Z"} 2026-09-26T04:04:40+00:00