Unknown
nvd
·
CVE-2026-51882
CVE-2026-51882: The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An a
Published Oct 1, 2026
The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openai_files directory by crafting malicious filenames.
Affected AI Products
langchain
openai