2.6
CVE-2026-7846
- EPSS 0.16%
- Veröffentlicht 05.05.2026 16:16:19
- Zuletzt bearbeitet 05.05.2026 19:06:58
- Quelle cna@vuldb.com
- CVE-Watchlists
- Unerledigt
chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctou
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerchatchat-space
≫
Produkt
Langchain-Chatchat
Version
0.3.1.0
Status
affected
Version
0.3.1.1
Status
affected
Version
0.3.1.2
Status
affected
Version
0.3.1.3
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.057 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@vuldb.com | 2.6 | 1.2 | 1.4 |
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
|
| cna@vuldb.com | 1.2 | 0 | 0 |
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| cna@vuldb.com | 1.4 | 2.5 | 2.9 |
AV:A/AC:H/Au:S/C:N/I:P/A:N
|
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
https://github.com/chatchat-space/Langchain-Chatchat/
https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-2-Silent-File-Overwrite.md
https://github.com/chatchat-space/Langchain-Chatchat/issues/5463
https://vuldb.com/submit/807795
https://vuldb.com/vuln/361125
https://vuldb.com/vuln/361125/cti