CVE-2026-7844
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Langchain-Chatchat up to version 0.3.1.3, a vulnerability involves missing authentication in the Compatible File Service component. Functions files/list_files/retrieve_file/retrieve_file_content/delete_file in openai_routes.py lack authentication. The attack requires local network access. The exploit is public.
Risk Assessment
The risk involves unauthorized access to files and operations by an attacker on the local network, potentially leading to data leakage or deletion.
Recommendation
Immediately restrict local network access and monitor the project for a patch. Until an update is available, manually secure the endpoints.
Original NVD description (English source)
A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/retrieve_file/retrieve_file_content/delete_file of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Compatible File Service. The manipulation results in missing authentication. The attacker must have access to the local network to execute the attack. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.