PT-2026-37091 · Unknown · Langchain-Chatchat

Dem00 · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-7847

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Langchain-Chatchat versions prior to 0.3.1.4

Description An issue exists in the Uploaded File Handler component within the get file id() function of the file libs/chatchat-server/chatchat/server/api server/openai routes.py. Manipulation of this function can result in the generation of insufficiently random values. Successful exploitation requires access to the local network and is characterized by high complexity and difficult exploitability.

Recommendations As a temporary workaround, consider restricting access to the get file id() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-310

Related Identifiers

CVE-2026-7847

GHSA-JV4P-MHMP-69VW

Affected Products

Langchain-Chatchat

References · 12

• 🔥 https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-3-Predictable-File-ID.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7847 · Security Note
• https://osv.dev/vulnerability/GHSA-jv4p-mhmp-69vw · Vendor Advisory
• https://github.com/chatchat-space/Langchain-Chatchat · Note
• https://github.com/chatchat-space/Langchain-Chatchat/issues/5464 · Note
• https://vuldb.com/vuln/361126 · Note
• https://t.me/CVEtracker/52777 · Telegram Post
• https://vuldb.com/submit/807796 · Note
• https://twitter.com/CVEnew/status/2051741663974887503 · Twitter Post
• https://t.me/cveNotify/162237 · Telegram Post
• https://twitter.com/infoflowcloud/status/2051742857514397750 · Twitter Post
• https://vuldb.com/vuln/361126/cti · Note