Advisory · CVE-2026-120315
Authenticated path traversal in LobeHub Chat can overwrite app files and reach code execution
An authenticated LobeHub Chat user can supply a traversal filename that escapes the temp directory during document parsing, overwriting application files such as startServer.js for remote code execution. LobeChat server-database deployments from 1.84.26 before 2.1.49 are affected.
- Vendor
- LobeHub
- Product
- LobeHub Chat
- Identifier / CWE
- CVE-2026-120315
CWE-22 - Action timing
- Immediate
Explain it like I’m five
The chat app lets a user name an uploaded file, and when it later parses that file it drops it into a folder without checking the name. A name full of up-one-level steps walks the file out of its folder and onto any file the app can write, including the app itself.
- 01Traversal file record
An authenticated user creates a file record whose name contains path traversal sequences, such as a path climbing out of the temp directory toward the application root.
- 02Parsing triggered
The user triggers document parsing, which downloads the file content locally through the file service.
- 03Unsanitized temp write
The temp file writer joins the temp directory with the user-supplied name without sanitizing it, so the content lands outside the intended directory.
- 04Application file overwritten
Overwriting an application file such as startServer.js takes effect when the service restarts, giving the attacker code execution, or corrupts the deployment into a crash loop.
What happened
LobeHub disclosed CVE-2026-120315 in LobeHub Chat, a path traversal flaw in the file parsing path rated high at CVSS 8.8. NVD lists LobeChat server-database deployments from version 1.84.26 before 2.1.49 as affected, with 2.1.49 unaffected.
The advisory traces the flaw to the temp file writer used during document parsing: user-supplied filenames are passed unsanitized to a path join when writing temporary files. A file record created through the file creation procedure carries the attacker-chosen name, and triggering document parsing writes the file content to the traversed location. The advisory notes any authenticated user can exploit it, multi-tenant deployments are at highest risk, and deployments with self-registration enabled let an unauthenticated attacker register first and then exploit it. Overwriting application files can lead to remote code execution, data exfiltration via configuration files, or denial of service by corrupting critical files.
What to do
- Inventory LobeHub Chat server-database deployments, especially multi-tenant instances and any with self-registration enabled.
- Upgrade affected deployments to LobeHub Chat 2.1.49 or later.
- Until upgraded, consider disabling self-registration and restricting who can upload files and trigger document parsing.
- Review file creation and document parsing logs for filenames containing traversal sequences and for unexpected writes outside the temp directory.
- Check application files, configuration, and mounted volumes for unexpected modifications, and treat any overwritten file as a possible compromise.
- Verify the deployed version after upgrading.
Management note
This is an authenticated-to-RCE path in a self-hosted AI chat platform, and self-registration turns it into an effectively unauthenticated one on open deployments. The fix is a version upgrade, but the investigation matters as much: a traversal write can persist as a backdoor in an application file long after the patch lands.