PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7847 chatchat-space CVE debrief

A vulnerability was found in Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult.

Vendor
chatchat-space
Product
Langchain-Chatchat
CVSS
LOW 1.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-07-24
Advisory published
2026-05-05
Advisory updated
2026-07-24

Who should care

Users of Langchain-Chatchat up to 0.3.1.3 who require secure file handling and are concerned about potential local network attacks. This includes operators managing Langchain-Chatchat deployments, platform administrators responsible for ensuring the security of file handling components, vulnerability management teams assessing the risk of insufficiently random file IDs, and security teams monitoring for suspicious activity related to file uploads.

Technical summary

The vulnerability is located in the _get_file_id function of the openai_routes.py file within the Langchain-Chatchat project. This function is part of the Uploaded File Handler component. The issue arises from the function's generation of insufficiently random values, which could potentially be exploited to predict file IDs. The vulnerability has been rated with a CVSS score of 1.2 and a severity of LOW.

Defensive priority

Medium priority due to the high complexity of the attack and the requirement for local network access.

Recommended defensive actions

  • Review and update the _get_file_id function in openai_routes.py to ensure it generates sufficiently random and unique file IDs.
  • Implement additional security measures to restrict access to the Uploaded File Handler component.
  • Monitor for any suspicious activity related to file uploads and ID generation.
  • Consider compensating controls such as file upload validation and verification processes.
  • Perform a thorough review of the Langchain-Chatchat project repository to identify any similar vulnerabilities.
  • Conduct a security audit of the Uploaded File Handler component to ensure it is properly secured.
  • Develop and implement a plan to track and verify file uploads and their corresponding IDs.

Evidence notes

The CVE record was published on 2026-05-05T17:17:05.153Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Deferred. The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7847 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7847

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7847 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7847

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.