CVE-2026-7846
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Langchain-Chatchat up to version 0.3.1.3, the OpenAI-Compatible File Upload API has a time-of-check time-of-use (TOCTOU) vulnerability when processing the file.filename argument. The exploit is public and the project has not responded.
Risk Assessment
An attacker with local network access can exploit the race condition between file check and use, potentially leading to unauthorized access or data modification.
Recommendation
Restrict API access to trusted networks and consider temporary mitigations until a patch is released.
Original NVD description (English source)
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.