CVE-2026-86099

EUVD-2026-74908
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
chainlitchainlit
𝑥
≤ 2.12.0
CNA
Common Weakness Enumeration
References
https://github.com/Chainlit/chainlit
https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/session.py
https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/socket.py
https://pypi.org/project/chainlit/
https://www.vulncheck.com/advisories/chainlit-through-2.12.0-path-traversal-via-socket-io-sessionid