Description

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-09T14:17:20.387Z",
  "pubdate": "2026-09-09T14:17:20.387Z",
  "executiveSummary": "Chainlit versions through 2.12.0 contain a critical path traversal vulnerability originating from improper validation of user-supplied input.\nThe vulnerability resides in the socket.io sessionId parameter, which fails to sanitize input, allowing attackers to escape the intended upload directory.\nAn unauthenticated attacker can exploit this flaw to perform arbitrary directory deletion within the scope of the service process permissions.\nThe risk is severe as it enables unauthorized deletion of system or application files, potentially leading to service disruption or data loss.\nSuccessful exploitation requires no prior authentication and can be executed over the network by sending crafted malicious sessionId payloads.\nOrganizations using Chainlit are at risk of remote file system manipulation, necessitating immediate attention to remediation or access controls.",
  "technicalDetails": "The vulnerability is a classic path traversal flaw located within the Chainlit socket.io handling mechanism. The root cause is the lack of strict input sanitization and path normalization for the sessionId parameter before it is used in filesystem operations.\nWhen a user connects, Chainlit utilizes the sessionId parameter to identify session-specific resources. Because the application fails to validate this input against expected patterns or restrict it to a specific base directory, an attacker can supply sequences such as '../' or absolute paths to escape the confinement of the designated upload or storage directory.\nThe attack flow begins when an unauthenticated attacker initiates a connection to the Chainlit socket.io interface. By injecting specially crafted path traversal sequences into the sessionId parameter, the attacker forces the underlying file system operations to resolve to arbitrary locations on the server.\nUpon successful traversal, the application logic processes the malicious path as if it were a legitimate session identifier. Due to the lack of access controls on the subsequent operations, the process uses its OS-level privileges to perform recursive deletion functions on the resolved paths.\nIf the Chainlit service process is running with sufficient privileges, the attacker can navigate outside the application root and target sensitive system directories or configuration files. The payload behavior involves directing the application's internal file deletion routines to delete files or directories that the service user has write/delete permissions for.\nThis vulnerability is present in all versions up to and including 2.12.0. Because the vulnerability is reachable through the primary socket.io communication channel, it is exposed to any network-accessible endpoint running the service. The impact is significant, as it effectively grants an unauthenticated remote user the ability to perform arbitrary file system destruction within the security context of the Chainlit instance."
}