PT-2026-3515 · Chainlit · Chainlit

Gal Zaban

+1

·

Publicado

2026-01-19

·

Atualizado

2026-01-23

·

CVE-2026-22218

CVSS v4.0

7.1

Alta

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Chainlit versions prior to 2.9.4
Description Chainlit versions prior to 2.9.4 have an arbitrary file read issue in the /project/element update process. An authenticated client can manipulate a custom Element with a user-controlled path, leading the server to copy the specified file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents through the /project/file/<chainlitKey> API endpoint, potentially exposing any file accessible by the Chainlit service. This allows unauthorized disclosure of sensitive information like configuration files, databases, or source code.
Recommendations Versions prior to 2.9.4 should be updated to version 2.9.4 or later.

Exploit

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-22218

Produtos afetados

Chainlit