What is CVE-2026-120315 in LobeHub Chat?
CVE-2026-120315 is a critical security flaw identified in LobeHub Chat with a CVSS score of 8.8, posing severe risks to server environments. The vulnerability resides in how file names are processed by the application.
Security advisories from Rust zip library vulnerability and similar tools remind us how path traversal impacts ecosystems, much like this incident where LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile().
How does the path traversal attack work?
Authenticated users can exploit this vulnerability by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.
Other infrastructure tools have faced similar risks, such as Kaniko credential leakage flaw or SUSE Rancher credential leaks, highlighting the importance of strict file and data validation.
How can I protect my system?
You must update your deployment to secure your infrastructure against potential remote code execution and service disruptions. Follow these steps to mitigate the vulnerability:
- Check your current LobeHub Chat installation version to determine if it falls between 1.84.26 and 2.1.48.
- Upgrade LobeHub Chat immediately to version 2.1.49 or any later patched release.
- Verify that file creation and document parsing endpoints are restricted and properly monitored for suspicious traversal patterns.