Arbitrary File Read Vulnerability in Chainlit by Chainlit
CVE-2026-22218
7.1HIGH
Key Information:
Badges
👾 Exploit Exists
What is CVE-2026-22218?
Chainlit versions before 2.9.4 are prone to an arbitrary file read vulnerability. This issue arises during the update flow for elements, where an authenticated user can manipulate the file path in a custom Element. As a result, the server may copy the targeted file into the attacker's session. Once the file is referenced, the attacker can access its contents through a unique identifier, compromising the confidentiality of any file accessible by the Chainlit service. It's essential for users to update to version 2.9.4 or later to mitigate this vulnerability.
Affected Version(s)
Chainlit 0 < 2.9.4
References
EPSS Score
8% chance of being exploited in the next 30 days.
CVSS V4
Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
Ido Shani and Gal Zaban of Zafran Security