CVE-2026-86099
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-22
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- Chainlit chainlit
Weakness type
Related vulnerabilities
- CVE-2026-9166 — LFI in GIS Informatics' GisLab Laboratory Management System
- CVE-2026-78085 — Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4
- CVE-2026-15019 — Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
- CVE-2026-18386 — WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
- CVE-2026-88069 — Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis
- CVE-2026-53956 — Rattler vulnerable to package cache path traversal via conda package build string
- CVE-2026-86775 — knowns before 0.30.0 Path Traversal via Document API
- CVE-2026-78485 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...