⬇ Scarica il santino: ·
San ChainLeak
Agiografia in preparazione presso lo scriptorium.
Festeggiato il 20 gennaio
Scheda tecnica
- Divulgata il
- 20 gennaio 2026
- CVE
- CVE-2026-22218CVE-2026-22219
- CVSS
- 8.3
- Prodotto
- Chainlit · Chainlit
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.
Fonti: zafran.io
Canonizzato in sede vacante