{"id":"CVE-2026-120315","published":"2026-11-02T03:17:29.457","lastModified":"2026-11-02T03:17:29.457","description":"LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lobehub/lobehub/security/advisories/GHSA-2g9j-v25c-4j97","tags":[]},{"url":"https://www.vulncheck.com/advisories/lobehub-chat-1.84.26-before-2.1.49-path-traversal-rce-via-writetempfile","tags":[]}],"exploitRefs":[{"url":"https://github.com/lobehub/lobehub/security/advisories/GHSA-2g9j-v25c-4j97","tags":[]}],"hasPoc":true,"ai":{"summary":"Authenticated users can exploit unsanitized file names in the writeTempFile() function to perform path traversal and write arbitrary files outside the intended directory, enabling remote code execution or denial of service by overwriting critical application files like startServer.js.","exploitability":"Exploitation requires valid authentication and knowledge of the vulnerable endpoint and file creation workflow, but is otherwise straightforward due to lack of input sanitization.","blast_radius":"Successful exploitation allows full compromise of confidentiality, integrity, and availability via arbitrary code execution or service disruption on the affected server.","remediation":"Upgrade to LobeHub Chat version 2.1.49 or later, where the path traversal vulnerability in writeTempFile() has been fixed.","detection":"Monitor for file creation events outside expected directories (e.g., attempts to write to application root or system paths) and anomalous writes to sensitive files like startServer.js; inspect logs for file.createFile requests containing path traversal sequences such as '../' in the filename parameter.","tags":["path-traversal","rce","auth-bypass","web","file-write"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:56:30.143Z"}}