Path Traversal in LobeHub Chat Allows File Write and Code Execution

Executive Summary

This is a path traversal vulnerability in LobeHub Chat versions before 2.1.49. It allows authenticated users to write arbitrary files to the server's file system by exploiting unsanitized user input in filenames. The flaw exists in the writeTempFile() method where user-controlled filenames are passed directly to path construction without sanitization. Attackers can use path traversal sequences like ../../../../../../app/startServer.js to overwrite critical application files.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious file creation or modification in the LobeChat application directory, particularly files like startServer.js. Review logs for file.createFile API calls with traversal sequences (e.g., ../../../../). Inspect the writeTempFile() function in src/server/utils/tempFileManager.ts for unsanitized filename handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables multiple attack vectors including Remote Code Execution (RCE) via overwriting server files, Denial of Service (DoS) by corrupting application files, data exfiltration by modifying configuration files, and container escape in deployment environments. Attackers can read sensitive files, modify application code, inject backdoors, or permanently crash the application.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LobeChat to version 2.1.49 or later immediately. Disable file upload features if not required. Implement strict input validation for filenames in file operations. Restrict write permissions to application directories. Monitor for unauthorized file modifications or unexpected file creations.

Useful 0 Not Useful 0