Chainlit through 2.12.0 Path Traversal via socket.io sessionId
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Affected products
Chainlit · chainlitReferences
https://github.com/Chainlit/chainlithttps://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/session.pyhttps://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/socket.pyhttps://pypi.org/project/chainlit/https://www.vulncheck.com/advisories/chainlit-through-2.12.0-path-traversal-via-socket-io-sessionid