Llobehub

Products

Exploited and recent CVEs

• CVE-2026-120315 High 8.8 LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile 0.4%
• CVE-2026-85621 Medium 6.5 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu 0.2%
• CVE-2026-72594 High 7.6 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload 0.3%
• CVE-2026-59100 Medium 5.0 LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations 0.3%
• CVE-2026-59098 Medium 6.5 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search 0.4%
• CVE-2026-59095 High 7.7 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl 0.4%
• CVE-2026-58580 Medium 5.9 LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes 0.2%
• CVE-2026-58578 Medium 6.5 LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import 0.5%
• CVE-2026-54157 Critical 9.0 LobeHub: Unauthenticated SSRF in `/webapi/proxy` 1.8%
• CVE-2026-42045 Medium 6.2 LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) 0.3%
• CVE-2026-39411 Medium 5.0 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header 0.1%
• CVE-2026-23835 Medium 5.7 LobeHub Vulnerable to Improper Authorization in Presigned Upload 0.4%
• CVE-2026-23522 Low 3.7 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion 0.2%
• CVE-2026-23733 Medium 6.4 Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) 0.1%
• CVE-2025-62505 Low 3.0 SSRF in lobehub/lobe-chat with native web fetch module 0.3%
• CVE-2025-59426 Medium 4.3 lobe-chat has an Open Redirect 0.4%
• CVE-2025-59417 Medium 6.8 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages 0.4%
• CVE-2024-32965 High 8.1 ssrf vulnerability in lobe-chat 26.1%
• CVE-2024-47066 Critical 9.0 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) 11.9%
• CVE-2024-37895 Medium 5.7 API Key Leak in lobe-chat 0.5%
• CVE-2024-32964 Critical 9.0 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability 53.0%
• CVE-2024-24566 Medium 5.3 Lobe Chat unauthorized access to plugins 0.5%