CVE-2026-7847
published 2026-05-05CVE-2026-7847: A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file…
PriorityP414low2.6CVSS 3.1
AVAACHPRLUINSUCLINAN
EPSS
0.24%
14.2th percentile
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | — | — |
| chatchat-space | langchain-chatchat | 0 – 0.3.1.3 | — |
CVSS provenance
nvdv3.12.6LOWCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.01.2LOWCVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.4LOWAV:A/AC:H/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
chatchat-space Langchain-Chatchat up to 0.3.1.3 Uploaded File openai_routes.py _get_file_id random values (Issue 5464 / CNNVD-202605-760)
vuldb·2026-05-07·CVSS 1.2
CVE-2026-7847 [LOW] chatchat-space Langchain-Chatchat up to 0.3.1.3 Uploaded File openai_routes.py _get_file_id random values (Issue 5464 / CNNVD-202605-760)
A vulnerability identified as problematic has been detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values.
This vulnerability is known as CVE-2026-7847. Access to the local network is required for this attack. Furthermore, an exploit is available.
The project was informed of the problem early through an issue report but has not responded yet.
GHSA
GHSA-jv4p-mhmp-69vw: A vulnerability was found in chatchat-space Langchain-Chatchat up to 0
ghsa_unreviewed·2026-05-05
CVE-2026-7847 [LOW] GHSA-jv4p-mhmp-69vw: A vulnerability was found in chatchat-space Langchain-Chatchat up to 0
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
GHSA
Langchain-Chatchat Uses Insufficiently Random Values
ghsa·2026-05-05
CVE-2026-7847 [LOW] CWE-330 Langchain-Chatchat Uses Insufficiently Random Values
Langchain-Chatchat Uses Insufficiently Random Values
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-3-Predictable-File-ID.mdhttps://github.com/chatchat-space/Langchain-Chatchat/https://github.com/chatchat-space/Langchain-Chatchat/issues/5464https://vuldb.com/submit/807796https://vuldb.com/vuln/361126https://vuldb.com/vuln/361126/cti
2026-05-05
Published