Live › vulnerability › CVE-2026-120315
LobeHub Chat versions from 1.84.26 before 2.1.49 fail to sanitize file names passed to writeTempFile(). An authenticated user can create a file record with a traversal name and trigger parsing to overwrite application files such as startServer.js, leading to code execution or denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Self-hosted LobeHub Chat deployments in the affected range where users have accounts and can upload files that get parsed. Instances where only trusted users can sign in and file parsing is unused are at lower risk, but the sources do not say how the authenticated path is gated.
No product ranges from the sources yet.
1.84.26 to 2.1.492.1.49Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-120315")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.