LobeHub - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/lobehub/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 07:16:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLobeChat: Path traversal arbitrary file write (CVE-2026-120315)https://feed.craftedsignal.io/briefs/2026-11-lobechat-path-traversal/Mon, 02 Nov 2026 07:16:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-lobechat-path-traversal/LobeChat versions 1.84.26 through 2.1.48 contain a path traversal vulnerability in writeTempFile that allows authenticated users to achieve remote code execution by overwriting application startup scripts.LobeChat versions 1.84.26 up to 2.1.49 contain a path traversal vulnerability in the writeTempFile() function. An authenticated attacker can supply a malicious filename to the file.createFile method to write files outside of the intended directory. By triggering document parsing features, the attacker can overwrite sensitive application files, such as startServer.js, to achieve remote code execution or cause denial of service.

Impact

Authenticated users can achieve remote code execution (RCE) by overwriting application startup files or render the application unusable through arbitrary file overwriting (Denial of Service).

Recommendation

Update LobeChat instances to version 2.1.49 or later immediately to patch the path traversal vulnerability in the writeTempFile function. Perform an audit of temporary file directories and application source code integrity to ensure no malicious files have been planted or existing files modified by unauthorized users prior to patching.

]]>highadvisory