PatchSiren cyber security CVE debrief
CVE-2026-7847 chatchat-space CVE debrief
A vulnerability was found in Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult.
- Vendor
- chatchat-space
- Product
- Langchain-Chatchat
- CVSS
- LOW 1.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-05
- Original CVE updated
- 2026-07-24
- Advisory published
- 2026-05-05
- Advisory updated
- 2026-07-24
Who should care
Users of Langchain-Chatchat up to 0.3.1.3 who require secure file handling and are concerned about potential local network attacks. This includes operators managing Langchain-Chatchat deployments, platform administrators responsible for ensuring the security of file handling components, vulnerability management teams assessing the risk of insufficiently random file IDs, and security teams monitoring for suspicious activity related to file uploads.
Technical summary
The vulnerability is located in the _get_file_id function of the openai_routes.py file within the Langchain-Chatchat project. This function is part of the Uploaded File Handler component. The issue arises from the function's generation of insufficiently random values, which could potentially be exploited to predict file IDs. The vulnerability has been rated with a CVSS score of 1.2 and a severity of LOW.
Defensive priority
Medium priority due to the high complexity of the attack and the requirement for local network access.
Recommended defensive actions
- Review and update the _get_file_id function in openai_routes.py to ensure it generates sufficiently random and unique file IDs.
- Implement additional security measures to restrict access to the Uploaded File Handler component.
- Monitor for any suspicious activity related to file uploads and ID generation.
- Consider compensating controls such as file upload validation and verification processes.
- Perform a thorough review of the Langchain-Chatchat project repository to identify any similar vulnerabilities.
- Conduct a security audit of the Uploaded File Handler component to ensure it is properly secured.
- Develop and implement a plan to track and verify file uploads and their corresponding IDs.
Evidence notes
The CVE record was published on 2026-05-05T17:17:05.153Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Deferred. The project was informed of the problem early through an issue report but has not responded yet.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-05T17:17:05.153Z and has not been modified since then. The NVD entry is currently Deferred.