CyberRota Analysis
AI-GeneratedThe knowledge base creation and document upload interfaces in Langchain-Chatchat versions 0.3.0 and 0.3.1 are susceptible to path traversal attacks, allowing an attacker to manipulate the `knowledge_base_name` parameter to write data to unauthorized locations outside the designated directory. This vulnerability could lead to unauthorized access to sensitive information or system compromise. Organizations using these specific versions should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.