PT-2026-5439 · Lobehub · Lobehub

Uko3211 · Published 2026-01-30 · Updated 2026-02-01 · CVE-2026-23835

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LobeHub versions prior to 1.143.3

Description LobeHub is an open source human-and-AI-agent network. The file upload feature in Knowledge Base > File Upload does not validate the integrity of the upload request, allowing users to intercept and modify request parameters. This can lead to the creation of arbitrary files in unintended paths. An attacker can manipulate the size parameter in the client upload request to misrepresent the actual file size, bypassing the monthly upload quota and potentially causing financial impact to the service operator. This manipulation can also lead to degraded service availability, affecting legitimate users and overloading downstream systems. A single malicious user can cause an indirect denial of service (DoS) to other users.

Recommendations Update to version 1.143.3 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-23835

GHSA-WRRR-8JCV-WJF5

Affected Products

Lobehub

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23835.json · Exploit
• https://osv.dev/vulnerability/GHSA-wrrr-8jcv-wjf5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23835 · Security Note
• https://github.com/lobehub/lobehub · Note
• https://github.com/lobehub/lobehub/commit/2c1762b85acb84467ed5e799afe1499cd2f912e6 · Note
• https://github.com/lobehub/lobehub/security/advisories/GHSA-wrrr-8jcv-wjf5 · Note
• https://twitter.com/dailycve/status/2018021144536744192 · Twitter Post
• https://twitter.com/CVEnew/status/2017340979297038789 · Twitter Post
• https://t.me/CVEtracker/43322 · Telegram Post