PT-2026-3515 · Chainlit · Chainlit

Gal Zaban

+1

·

Published

2026-01-19

·

Updated

2026-01-23

·

CVE-2026-22218

CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Chainlit versions prior to 2.9.4
Description Chainlit versions prior to 2.9.4 have an arbitrary file read issue in the /project/element update process. An authenticated client can manipulate a custom Element with a user-controlled path, leading the server to copy the specified file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents through the /project/file/<chainlitKey> API endpoint, potentially exposing any file accessible by the Chainlit service. This allows unauthorized disclosure of sensitive information like configuration files, databases, or source code.
Recommendations Versions prior to 2.9.4 should be updated to version 2.9.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-22218

Affected Products

Chainlit