Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck
CVE-2026-86099Chainlit through 2.12.0 Path Traversal via socket.io sessionId
High 8.2
In plain English
A high-severity path traversal in chainlit from Chainlit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 51.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- Product Repository product
- Vulnerable files_dir property and rmtree sink technical-description
- Client-supplied sessionId assignment technical-description
- PyPI Package product
- VulnCheck Advisory: Chainlit through 2.12.0 Path Traversal via socket.io sessionId third-party-advisory