AI Threat Alert
CVE-2026-51882
AWAITING NVDThe OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious...
Full CISO analysis pending enrichment.
How severe is it?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-51882?
The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.
Is CVE-2026-51882 actively exploited?
No confirmed active exploitation of CVE-2026-51882 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-51882?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-51882?
No CVSS score has been assigned yet.
What are the technical details?
Original Advisory
The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.