Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-51883

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Langchain-Chatchat 0.3.0 和 0.3.1 版本中，知识库创建和文档上传接口存在路径遍历漏洞。攻击者可以在 参数中注入路径遍历序列（如 ），从而将知识库内容写入到配置的知识库根目录之外的任意位置。

AI Predicted 8.1 Difficulty: Easy EPSS 0.14% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
n/a n/a n/a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-51883

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2026-51883

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-51883

请登录查看更多情报信息。

Proof of Concept for CVE-2026-51883 (1)

Other References for CVE-2026-51883 (1)

Same Patch Batch · n/a · 2026-10-01 · 21 CVEs total

CVE-2026-103484 8.8 HIGH pgvector buffer overflow in IVFFlat index build
CVE-2026-103531 5.5 MEDIUM OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
CVE-2026-51876 DeepTutor 1.4.0授权绕过漏洞
CVE-2026-51875 Devika v1.0存在路径遍历漏洞
CVE-2026-51892 RagFlow 0.24.0 /v1/document/get/ 接口访问控制错误漏洞
CVE-2026-51896 RagFlow 0.25.3恢复模块越权访问漏洞
CVE-2026-51882 Langchain-Chatchat 0.3.0 文件上传路径穿越漏洞
CVE-2026-51886 LangFlow v1.9.3代码注入漏洞
CVE-2026-51878 DeepTutor 1.4.0 对象标识符授权绕过漏洞
CVE-2026-51873 Devika v1.0目录遍历漏洞
CVE-2026-51881 DeepTutor 1.4.0远程代码注入漏洞
CVE-2026-51879 DeepTutor 1.4.0 认证绕过漏洞
CVE-2026-51897 RAGFlow 0.24.0 get_dataset接口存在命令执行漏洞
CVE-2026-51884 Langchain Chatchat 0.3.1临时文档上传路径遍历漏洞
CVE-2026-51888 Langflow v1.8.4 目录遍历漏洞
CVE-2026-51893 RagFlow 0.24.0 越权访问漏洞
CVE-2026-51880 Deeptutor 1.4.0 EditFileTool路径遍历漏洞
CVE-2026-51895 Ragflow 0.24.0及之前版本存在更新元数据不当访问控制漏洞
CVE-2026-51874 Devika v1.0路径穿越漏洞
CVE-2026-51894 RAGFlow 0.24.0 任意文件读取漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2026-51883

No comments yet

Leave a comment