CVE-2026-51884

Summary

The flaw allows path traversal, enabling attackers to write files to arbitrary locations on the server, bypassing intended restrictions.

Exploitability

Exploitation is moderately hard as it requires crafting specific filenames, but preconditions include access to the /knowledge_base/upload_temp_docs endpoint.

Blast radius

If exploited, attackers could gain control over server files, leading to data loss or compromise of server functionality.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Langchain Chatchat 0.3.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.