漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Chainlit < 2.9.4 Arbitrary File Read via /project/element
Vulnerability Description
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.
CVSS Information
N/A
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
Chainlit 路径遍历漏洞
Vulnerability Description
Chainlit是chainlit开源的一个大模型对话界面框架。 Chainlit 2.9.4之前版本存在路径遍历漏洞，该漏洞源于对/project/element更新流程中路径参数处理不当，可能导致任意文件读取。
CVSS Information
N/A
Vulnerability Type
N/A