Chainlit Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read has been identified in Chainlit versions prior to 2.9.4. This issue arises in the /project/element update flow, where an authenticated client can send a custom Element with a user-controlled path. This action causes the server to copy the referenced file into the attacker's session. The attacker can then use the resulting element identifier (chainlitKey) to retrieve the file contents via the /project/file/<chainlitKey> endpoint, disclosing any file that is readable by the Chainlit service.

Impact

Exploitation of this vulnerability allows for unauthorized disclosure of files accessible to the Chainlit service, potentially leading to exposure of sensitive information.

Remediation

Users are advised to update Chainlit to version 2.9.4 or later, where this vulnerability has been fixed.