CVE-2026-86099

Deferred Deferred - Pending Action

Chainlit Path Traversal via Unauthenticated socket.io sessionId

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86099

EUVD

EUVD-2026-74908

Affected Vendors & Products

Vendor	Product	Version / Range
chainlit	chainlit	to 2.12.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Chainlit through version 2.12.0 fails to validate the client-supplied socket.io sessionId parameter. This allows unauthenticated attackers to inject absolute or relative path sequences, enabling filesystem path traversal. Attackers can escape the upload directory and recursively delete arbitrary directories accessible to the service process.

Detection Guidance

To detect this vulnerability, inspect WebSocket traffic for sessionId parameters containing path traversal sequences like '../' or absolute paths. Check Chainlit logs for unauthorized filesystem access attempts or recursive directory deletions. Monitor for unusual session restoration patterns in socket.py logs.

Impact Analysis

This vulnerability allows attackers to delete arbitrary directories on the server where Chainlit is running. If the service has access to sensitive directories, data loss or system compromise could occur. Unauthorized access to user sessions or interactions may also be possible through session manipulation.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or access, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or destroyed due to the path traversal flaw.

Mitigation Strategies

Upgrade Chainlit to the latest version beyond 2.12.0. Implement strict input validation for sessionId parameters to reject path traversal sequences. Restrict filesystem permissions for the Chainlit service process to minimize damage from potential exploits. Disable WebSocket connections if not required.

Hi! I’m here to help you understand CVE-2026-86099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70