CVE-2026-7846
published 2026-05-05CVE-2026-7846: A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file…
PriorityP416low2.6CVSS 3.1
AVAACHPRLUINSUCNILAN
EPSS
0.16%
5.7th percentile
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | 0 – 0.3.1.3 | — |
CVSS provenance
nvdv3.12.6LOWCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.01.2LOWCVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.4LOWAV:A/AC:H/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x229-w2j4-h748: A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0
ghsa_unreviewed·2026-05-05
CVE-2026-7846 [LOW] CWE-362 GHSA-x229-w2j4-h748: A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
GHSA
Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API
ghsa·2026-05-05
CVE-2026-7846 [LOW] CWE-362 Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API
Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-2-Silent-File-Overwrite.mdhttps://github.com/chatchat-space/Langchain-Chatchat/https://github.com/chatchat-space/Langchain-Chatchat/issues/5463https://vuldb.com/submit/807795https://vuldb.com/vuln/361125https://vuldb.com/vuln/361125/cti
2026-05-05
Published