https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:06:04 +0000 https://cve.radiocsirt.org/vuln/cve-2026-22218 <p><strong>Affected:</strong> Chainlit</p> <p>Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/&lt;chainlitKey&gt;, allowing disclosure of any file readable by the Chainlit service.</p> <p><strong>Affected:</strong> Chainlit</p> <p>Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/&lt;chainlitKey&gt;, allowing disclosure of any file readable by the Chainlit service.</p> https://cve.radiocsirt.org/vuln/cve-2026-22218