CVE-2026-22218
Chainlit < 2.9.4 Arbitrary File Read via /project/element
Description
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.
INFO
Published Date :
Jan. 20, 2026, 12:15 a.m.
Last Modified :
Feb. 2, 2026, 8:56 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Chainlit to version 2.9.4 or later.
- Review accessible files for compromise.
- Implement input validation for file paths.
- Restrict file access based on permissions.
Public PoC/Exploit Available at Github
CVE-2026-22218 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-22218.
| URL | Resource |
|---|---|
| https://github.com/Chainlit/chainlit/releases/tag/2.9.4 | Product Release Notes |
| https://www.vulncheck.com/advisories/chainlit-arbitrary-file-read-via-project-element | Third Party Advisory |
| https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover | Exploit Mitigation Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-22218 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-22218
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
AI Security Newsletter - A monthly digest of AI security research, insights, reports, upcoming events, and tools & resources
ai artifical-intelligense cybersecurity newsletter security
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-22218 vulnerability anywhere in the article.
-
CybersecurityNews
Critical Chainlit AI Vulnerabilities Let Hackers Gain Control Over Cloud Environments
Cybersecurity researchers have uncovered two critical security flaws in Chainlit, a widely used open-source AI framework with over 700,000 monthly downloads. The vulnerabilities allow attackers to ste ... Read more
-
BleepingComputer
Chainlit AI framework bugs let hackers breach cloud environments
Two high-severity vulnerabilities in Chainlit, a popular open-source framework for building conversational AI applications, allow reading any file on the server and leaking sensitive information. The ... Read more
-
The Hacker News
Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs
Security vulnerabilities were uncovered in the popular open-source artificial intelligence (AI) framework Chainlit that could allow attackers to steal sensitive data, which may allow for lateral movem ... Read more
-
The Register
AI framework flaws put enterprise clouds at risk of takeover
Two "easy-to-exploit" vulnerabilities in the popular open-source AI framework Chainlit put major enterprises' cloud environments at risk of leaking data or even full takeover, according to cyber-threa ... Read more
The following table lists the changes that have been made to the
CVE-2026-22218 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Feb. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:chainlit:chainlit:*:*:*:*:*:*:*:* versions up to (excluding) 2.9.4 Added Reference Type VulnCheck: https://github.com/Chainlit/chainlit/releases/tag/2.9.4 Types: Product, Release Notes Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/chainlit-arbitrary-file-read-via-project-element Types: Third Party Advisory Added Reference Type VulnCheck: https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover Types: Exploit, Mitigation, Third Party Advisory -
CVE Modified by [email protected]
Jan. 20, 2026
Action Type Old Value New Value Added Reference https://www.zafran.io/resources/chainleak-critical-ai-framework-vulnerabilities-expose-data-enable-cloud-takeover -
New CVE Received by [email protected]
Jan. 20, 2026
Action Type Old Value New Value Added Description Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-22 Added Reference https://github.com/Chainlit/chainlit/releases/tag/2.9.4 Added Reference https://www.vulncheck.com/advisories/chainlit-arbitrary-file-read-via-project-element