https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 00:50:14 +0000 https://vulnerability.circl.lu/sighting/39254ccc-f496-4358-8cb5-a89b2761484b/export {"uuid": "39254ccc-f496-4358-8cb5-a89b2761484b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51884", "type": "seen", "source": "https://gist.github.com/Ro1ME/da028c9ce13dd888e265b9bef01d6eca", "content": "# CVE-2026-51884\n\n**Type:** Directory Traversal\n**Product:** Langchain-Chatchat\n**Affected versions:** 0.3.1\n**Affected component:** `libs/chatchat-server/chatchat/server/chat/file_chat.py:file_chat-_parse_files_in_thread-a-full-service-post-knowledge-base-upload-temp`\n**Reference:** https://github.com/chatchat-space/Langchain-Chatchat/issues/5466\n\n## Description\n\nThe /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:46.000000Z"} {"uuid": "39254ccc-f496-4358-8cb5-a89b2761484b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51884", "type": "seen", "source": "https://gist.github.com/Ro1ME/da028c9ce13dd888e265b9bef01d6eca", "content": "# CVE-2026-51884\n\n**Type:** Directory Traversal\n**Product:** Langchain-Chatchat\n**Affected versions:** 0.3.1\n**Affected component:** `libs/chatchat-server/chatchat/server/chat/file_chat.py:file_chat-_parse_files_in_thread-a-full-service-post-knowledge-base-upload-temp`\n**Reference:** https://github.com/chatchat-space/Langchain-Chatchat/issues/5466\n\n## Description\n\nThe /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:04:46.000000Z"} https://vulnerability.circl.lu/sighting/39254ccc-f496-4358-8cb5-a89b2761484b/export Sat, 26 Sep 2026 04:04:46 +0000