CVE-2026-7847
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in Langchain-Chatchat up to version 0.3.1.3 in the _get_file_id function of the Uploaded File Handler component generates insufficiently random values, potentially allowing an attacker to predict file IDs. The attack requires local network access and is considered difficult.
Risk Assessment
An attacker could predict file IDs, potentially leading to unauthorized access to or manipulation of uploaded files.
Recommendation
Contact the project author for a fix or apply temporary mitigations such as restricting local network access.
Original NVD description (English source)
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.