High
Chainlit through 2.12.0 Path Traversal via socket.io sessionId
Type: advisorySources: OSV
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86099
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:15 UTC · Revision 1
Source evidence
Chainlit through 2.12.0 Path Traversal via socket.io sessionId
core-osv · Original sourcePublished 9 Sept 2026, 13:31 UTC
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
osv:CVE-2026-86099
Complete source record
{
"id": "5a4cf4ad14de0f6cc7486a5ca8e9b8fd11f3aaa0e63be507c003c4e1c6d55970",
"url": "https://osv.dev/vulnerability/CVE-2026-86099",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Chainlit through 2.12.0 Path Traversal via socket.io sessionId",
"summary": "Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.",
"evidence": "osv:CVE-2026-86099",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-86099",
"aliases": [
"CVE-2026-86099"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/chainlit/chainlit",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0565fd0eccb915fce159929598b053ed79f6e0c9"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.12.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.12.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"2.12.0",
"2.11.1",
"2.11.0",
"2.10.1",
"2.10.0",
"2.9.6",
"2.9.5",
"2.9.4",
"2.9.3",
"2.9.2",
"2.9.1",
"2.9.0",
"2.8.5",
"2.8.4",
"2.8.3",
"2.8.2",
"2.8.1",
"2.8.0",
"2.7.2",
"2.7.1.1",
"2.7.1",
"2.7.0",
"2.6.9",
"2.6.8",
"2.6.7",
"2.6.6",
"2.6.5",
"2.6.4",
"2.6.3",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.5",
"2.4.400",
"2.4.302",
"2.4.301",
"2.4.3",
"2.4.201",
"2.4.2",
"2.4.1",
"2.4.0",
"2.4.0rc0",
"2.3.0",
"2.2.1",
"2.2.0",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.603",
"2.0.602",
"2.0.601",
"2.0.6",
"2.0.5",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0.0",
"2.0rc1",
"2.0.dev2",
"2.0dev1",
"1.3.0rc0",
"2.0.dev0",
"1.2.0",
"1.1.404",
"1.1.403rc0",
"1.1.402",
"1.1.401",
"1.1.400",
"1.1.400rc1",
"1.1.400rc0",
"1.1.306-fix",
"1.1.306",
"1.1.305",
"1.1.304",
"1.1.303",
"1.1.302",
"1.1.301",
"1.1.300",
"1.1.300rc5",
"1.1.300rc4",
"1.1.300rc3",
"1.1.300rc2",
"1.1.300rc1",
"1.1.300rc0",
"1.1.202",
"1.1.201",
"1.1.200",
"1.1.101",
"1.1.0",
"1.1.0rc1",
"1.1.0rc0",
"1.0.506",
"1.0.505",
"1.0.504",
"1.0.503",
"1.0.502",
"1.0.501",
"1.0.500",
"1.0.401",
"1.0.400",
"1.0.301",
"1.0.300",
"1.0.200",
"1.0.101",
"1.0.100",
"1.0.0",
"1.0.0rc3",
"1.0.0rc2",
"1.0.0rc1",
"1.0.0rc0",
"0.7.700",
"0.7.604",
"0.7.604rc2",
"0.7.604rc1",
"0.7.604rc0",
"0.7.603",
"0.7.602",
"0.7.602rc0",
"0.7.601rc0",
"0.7.600rc1",
"0.7.600rc0",
"0.7.501",
"0.7.500",
"0.7.400",
"0.7.301",
"0.7.3",
"0.7.2",
"0.7.1",
"0.7.0",
"0.6.402",
"0.6.401",
"0.6.4",
"0.6.3",
"0.6.2",
"0.6.1",
"0.6.0",
"0.5.2",
"0.5.1",
"0.5.0",
"0.4.3",
"0.4.2",
"0.4.101",
"0.4.1",
"0.4.0",
"0.3.0",
"0.2.111",
"0.2.110",
"0.2.109",
"0.2.108",
"0.2.107",
"0.2.106",
"0.2.105",
"0.2.104",
"0.2.103",
"0.2.102",
"0.2.101",
"0.2.1",
"0.2.0",
"0.1.103",
"0.1.102",
"0.1.101",
"0.1.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86099.json"
}
}
],
"modified": "2026-10-28T02:30:22.005630713Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86099.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86099",
"https://www.vulncheck.com/advisories/chainlit-through-2.12.0-path-traversal-via-socket-io-sessionid",
"https://github.com/Chainlit/chainlit",
"https://pypi.org/project/chainlit/",
"https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/session.py",
"https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/socket.py"
],
"provider_metadata": {
"cwe_ids": [
"CWE-22"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86099.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86099",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488243,
"published_at": "2026-09-09T13:31:59.696+00:00"
}