{"id":"CVE-2026-120315","kind":"vulnerability","aliases":["CVE-2026-120315"],"related":[],"title":"LobeHub Chat: path traversal lets logged-in users overwrite server files","description":"LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.","summary":"LobeHub Chat versions from 1.84.26 before 2.1.49 fail to sanitize file names passed to writeTempFile(). An authenticated user can create a file record with a traversal name and trigger parsing to overwrite application files such as startServer.js, leading to code execution or denial of service.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-chat","ai-tooling","lobehub-chat","self-hosted"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"- Check the installed LobeHub Chat version against the affected range `1.84.26` to `2.1.49`\n- Confirm whether the deployment exposes user accounts with file upload and document parsing enabled","fix":"- Move to a LobeHub Chat release at or after `2.1.49`","status":"open","published_at":"2026-11-02T03:17:29+00:00","first_seen_at":"2026-11-02T03:31:22+00:00","triaged_at":"2026-11-02T03:31:46+00:00","updated_at":"2026-11-02T03:31:46+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-02T03:31:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a LobeHub Chat release at or after `2.1.49`","reach":"internet","title":"LobeHub Chat: path traversal lets logged-in users overwrite server files","impact":"high","summary":"LobeHub Chat versions from 1.84.26 before 2.1.49 fail to sanitize file names passed to writeTempFile(). An authenticated user can create a file record with a traversal name and trigger parsing to overwrite application files such as startServer.js, leading to code execution or denial of service.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["lobehub-chat","self-hosted","ai-chat"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker overwrites startServer.js and runs code on server","analyst_note":"Confirm from the NVD entry or the vendor advisory whether the file upload and document parsing path is on by default, and whether a fixed release is named.","how_to_check":"- Check the installed LobeHub Chat version against the affected range `1.84.26` to `2.1.49`\n- Confirm whether the deployment exposes user accounts with file upload and document parsing enabled","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","version-outside-range"],"who_is_affected":"Self-hosted LobeHub Chat deployments in the affected range where users have accounts and can upload files that get parsed. Instances where only trusted users can sign in and file parsing is unused are at lower risk, but the sources do not say how the authenticated path is gated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4158,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120315':15A,18A '-2026':14A,17A '1.84.26':35B,79C '2.1.49':37B,81C 'ai':20B,23B 'ai-chat':19B 'ai-tool':22B 'allow':88C 'applic':63B,120C 'arbitrari':93C 'attack':102C 'authent':47B,89C 'chat':2A,21B,27B,32B,77C 'code':70B,125C 'contain':82C 'creat':50B,104C 'cve':13A,16A 'denial':73B,128C 'document':116C 'execut':71B,126C 'fail':38B 'file':12A,41B,52B,64B,94C,98C,106C,121C 'file.createfile':109C 'host':30B 'lead':68B 'let':5A 'like':122C 'lobehub':1A,26B,31B,76C 'lobehub-chat':25B 'log':7A 'logged-in':6A 'name':42B,57B,99C,113C 'overwrit':10A,62B,119C 'pars':60B,117C 'pass':43B 'path':3A,84C 'record':53B,107C 'sanit':40B 'self':29B 'self-host':28B 'server':11A 'servic':75B,130C 'startserver.js':67B,123C 'suppli':96C 'tool':24B 'travers':4A,56B,85C,112C 'trigger':59B,115C 'unsanit':97C 'user':9A,48B,90C 'version':33B 'via':108C 'vulner':86C 'write':92C 'writetempfil':45B,101C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted LobeHub Chat deployments in the affected range where users have accounts and can upload files that get parsed. Instances where only trusted users can sign in and file parsing is unused are at lower risk, but the sources do not say how the authenticated path is gated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aichat","aitooling","high","lobehubchat","selfhosted"],"first_public_at":"2026-11-02T03:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120315","severity":null,"published_at":"2026-11-02T03:17:29+00:00","modified_at":"2026-11-02T03:17:29+00:00","first_seen_at":"2026-11-02T03:31:22+00:00","fetched_at":"2026-11-02T03:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}