CVE-2026-120315

Summary

Authenticated users can exploit unsanitized file names in the writeTempFile() function to perform path traversal and write arbitrary files outside the intended directory, enabling remote code execution or denial of service by overwriting critical application files like startServer.js.

Exploitability

Exploitation requires valid authentication and knowledge of the vulnerable endpoint and file creation workflow, but is otherwise straightforward due to lack of input sanitization.

Blast radius

Successful exploitation allows full compromise of confidentiality, integrity, and availability via arbitrary code execution or service disruption on the affected server.

Detection

Monitor for file creation events outside expected directories (e.g., attempts to write to application root or system paths) and anomalous writes to sensitive files like startServer.js; inspect logs for file.createFile requests containing path traversal sequences such as '../' in the filename parameter.

Prioritized remediation

Upgrade to LobeHub Chat version 2.1.49 or later, where the path traversal vulnerability in writeTempFile() has been fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.