CVE-2026-22218
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability in Chainlit versions prior to 2.9.4 allows an authenticated attacker to read arbitrary files on the server by manipulating the path in a project element update request. The attacker can copy the file to their session and then retrieve it using the element identifier.
Risk Assessment
The risk involves potential disclosure of sensitive data such as configuration files, private keys, or user data readable by the Chainlit service.
Recommendation
Immediately upgrade Chainlit to version 2.9.4 or later, which fixes this vulnerability.
Other vulnerabilities in Chainlit
See all- CVE-2026-45018Critical
Chainlit from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, exposes the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string, and validation only checks the executable name, allowing arbitrary command execution via the -c argument in npx.
- CVE-2026-22219High
An SSRF vulnerability in Chainlit before version 2.9.4 allows an authenticated attacker to make arbitrary HTTP requests from the server to internal network services or cloud metadata endpoints via a user-controlled URL in an Element during the /project/element update flow with the SQLAlchemy data layer backend.
- CVE-2026-82290Medium
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
- CVE-2026-45019High
Chainlit versions from 2.4.0rc0 to 2.12.0, when features.mcp.enabled is set to true, expose the POST /mcp endpoint without authentication. An attacker can control the URL and headers, allowing blind outbound requests to internal or external services, including cloud metadata endpoints, with arbitrary Authorization and Cookie headers. This issue is fixed in version 2.12.0.
- CVE-2026-56104High
Chainlit before version 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.
Original NVD description (English source)
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.