Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-10 | 1 | Disclosure1 |
| 2026-09-13 | 1 | Patch1 |
🚨 HIGH SEVERITY: CVE-2026-86099 (CVSS 8.2) Chainlit ≤2.12.0 vulnerable to path traversal via sessionId parameter. Unauthenticated attackers can delete arbitrary directories. Patch immediately! #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/KRxIreQmgA
Post summary
The tweet announces a high‑severity path traversal flaw in Chainlit (CVE-2026-86099) that allows unauthenticated deletions, and urges immediate patching.
🚨High - Chainlit Arbitrary Directory Deletion via http://socket.io sessionId Path Traversal (CVE-2026-86099) Chainlit <= 2.12.0 fails to validate the client-supplied http://socket.io sessionId parameter, allowing ../ or absolute-path traversal to escape the upload directory. Unauthenticated attackers can trigger recursive deletion of arbitrary directories accessible to the service account. 👉Affected: chainlit <= 2.12.0
Post summary
The post discloses a high‑severity path‑traversal vulnerability (CVE‑2026‑86099) in Chainlit <=2.12.0 that allows unauthenticated deletion of arbitrary directories, with no evidence of PoC, exploit code, or mitigation.