LobeChat: Path traversal arbitrary file write (CVE-2026-120315)

LobeChat versions 1.84.26 up to 2.1.49 contain a path traversal vulnerability in the writeTempFile() function. An authenticated attacker can supply a malicious filename to the file.createFile method to write files outside of the intended directory. By triggering document parsing features, the attacker can overwrite sensitive application files, such as startServer.js, to achieve remote code execution or cause denial of service.

Impact

Authenticated users can achieve remote code execution (RCE) by overwriting application startup files or render the application unusable through arbitrary file overwriting (Denial of Service).

Recommendation

Update LobeChat instances to version 2.1.49 or later immediately to patch the path traversal vulnerability in the writeTempFile function. Perform an audit of temporary file directories and application source code integrity to ensure no malicious files have been planted or existing files modified by unauthorized users prior to patching.