Race Condition in Langchain-Chatchat's OpenAI-Compatible File Upload API
CVE-2026-7846

2.1LOW

Key Information:

Vendor: Chatchat-space
Status: Langchain-chatchat
Vendor: CVE Published:; 5 May 2026

🔔 Create Chatchat-space Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7846?

A race condition vulnerability exists in Langchain-Chatchat's OpenAI-Compatible File Upload API, specifically within the function handling file uploads in openai_routes.py. This flaw allows for manipulation of the file.filename parameter, leading to a time-of-check to time-of-use (TOCTOU) issue. Attackers can exploit this vulnerability if they have access to the local network, although exploiting it requires a high level of complexity. While the problem has been publicly disclosed and the project team has been made aware, they have yet to respond to mitigate this security risk.

Affected Version(s)

Langchain-Chatchat 0.3.1.0

Langchain-Chatchat 0.3.1.1

Langchain-Chatchat 0.3.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7846 - Proof of Concept