CVE-2026-86099
Chainlit through 2.12.0 Path Traversal via socket.io sessionId
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Sep 4, 2026
Description
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
chainlitChainlit |
|
References
- Product Repositoryproduct
- Vulnerable files_dir property and rmtree sinktechnical-description
- Client-supplied sessionId assignmenttechnical-description
- PyPI Packageproduct
- VulnCheck Advisory: Chainlit through 2.12.0 Path Traversal via socket.io sessionIdthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.