CVE-2026-7844
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Langchain-Chatchat up to version 0.3.1.3, a vulnerability involves missing authentication in the Compatible File Service component. Functions files/list_files/retrieve_file/retrieve_file_content/delete_file in openai_routes.py lack authentication. The attack requires local network access. The exploit is public.
Risk Assessment
The risk involves unauthorized access to files and operations by an attacker on the local network, potentially leading to data leakage or deletion.
Recommendation
Immediately restrict local network access and monitor the project for a patch. Until an update is available, manually secure the endpoints.
Other vulnerabilities in Langchain-Chatchat
See all- CVE-2026-7847Low
A vulnerability in Langchain-Chatchat up to version 0.3.1.3 in the _get_file_id function of the Uploaded File Handler component generates insufficiently random values, potentially allowing an attacker to predict file IDs. The attack requires local network access and is considered difficult.
- CVE-2026-7846Low
In Langchain-Chatchat up to version 0.3.1.3, the OpenAI-Compatible File Upload API has a time-of-check time-of-use (TOCTOU) vulnerability when processing the file.filename argument. The exploit is public and the project has not responded.
- CVE-2026-7845Low
In Langchain-Chatchat up to 0.3.1.3, a vulnerability was found in the function PIL.Image.tobytes of dialogue.py in the Vision Chat Paste Image Handler component. Manipulation of the paste_image.image_data argument leads to use of weak hash. Local network access is required and the attack is difficult.
Original NVD description (English source)
A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/retrieve_file/retrieve_file_content/delete_file of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Compatible File Service. The manipulation results in missing authentication. The attacker must have access to the local network to execute the attack. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS