What’s Vulnerable › Vulnerabilities

CVE-2026-86099: Chainlit through 2.12.0 Path Traversal via socket.io sessionId

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-09
• Weakness: CWE-22

Description

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

Affected products

• chainlit: through 2.12.0

References

• https://github.com/Chainlit/chainlit
• https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/session.py
• https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/socket.py
• https://pypi.org/project/chainlit/
• https://www.vulncheck.com/advisories/chainlit-through-2.12.0-path-traversal-via-socket-io-sessionid

Get alerted when CVE-2026-86099 or the next vulnerability affects your stack