High severity8.2NVD Advisory· Published Sep 9, 2026· Updated Sep 9, 2026

CVE-2026-86099

Description

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pypi/Chainlitreferences
Package: https://pypi.org/project/chainlit
Chainlit/Chainlitllm-fuzzy
Range: <=2.12.0

Patches

Vulnerability mechanics

References

github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/session.pynvd
github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/socket.pynvd
pypi.org/project/chainlit/nvd
www.vulncheck.com/advisories/chainlit-through-2.12.0-path-traversal-via-socket-io-sessionidnvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000