CVE-2026-22218

This bug lets a logged-in attacker trick Chainlit into copying a file from the server into their own session. Once that copy exists, they can ask for it and view the file’s contents. Think of it like giving someone a key to the office, then letting them request any file from a shared cabinet and read what’s inside.

This matters if you run Chainlit as a service for users (including employees, contractors, or external customers) and your Chainlit version is below 2.9.4. The attacker must have valid credentials for a Chainlit session, and there’s no need for the victim to click anything. Reachability matters: it’s a risk if attackers can log into your Chainlit instance (and then reach the endpoints from that session).

Treat this as urgent enough to patch promptly: attackers only need an authenticated Chainlit session and can then read arbitrary files the service account can access. Even though it’s not listed as a KEV item, there is a public exploit available, and the fix is available in Chainlit 2.9.4. Patch now and then verify you haven’t exposed secrets before the upgrade.

Confirm whether you’re exposed

1. Determine your running Chainlit version.
   • If it’s below 2.9.4, you’re within scope for CVE-2026-22218.
2. Confirm whether your Chainlit instance is accessible to users who shouldn’t be trusted with file access.
   • This issue requires an authenticated Chainlit session (valid login/credentials) and no user interaction.

Upgrade (recommended fix)

• Upgrade Chainlit to 2.9.4 (fixed version per the findings).
• After upgrading, restart/redeploy your Chainlit service so the new version is active.

Validate mitigation

1. Check application/access logs after the upgrade for unexpected activity on:
   • /project/element
   • /project/file/<chainlitKey>
2. Look for patterns consistent with probing (repeated element creation followed by file retrieval) by the same authenticated user.

If you cannot upgrade immediately (workaround)

• Reduce who can reach the app:
  • Restrict access so only trusted users can access Chainlit (avoid public/unrestricted access).
• Assume any secrets accessible by the Chainlit service account could be exposed:
  • Rotate credentials used by the Chainlit service (for example, API keys or database passwords), especially if secrets are stored on the same host and readable by that service.

Ongoing monitoring

• Monitor for continued access to the project element/file functionality from authenticated users, especially any anomalous bursts or repeated attempts.

Due date / KEV

• This CVE is not listed in CISA KEV, so there is no specific CISA due date provided in the findings.

Severity is effectively “medium” in the provided scoring, but the impact can be high in practice because the attacker can read files directly.

• Weakness: CWE-22 (path traversal / path manipulation category).
• Mechanism: An authenticated client can send a crafted “Element” to the /project/element update flow with a user-controlled path. The server copies the referenced file into the attacker’s session under a generated key, which can then be used to retrieve the contents via /project/file/.
• Preconditions: target runs chainlit < 2.9.4 and attacker has valid credentials for a Chainlit session.
• Attack vector: network; no user interaction required.
• Exploit status: a public exploit is available (1 known).
• KEV: not listed in CISA KEV.
• Predicted likelihood: EPSS is reported as rising, but per guidance, public blocks should not rely on EPSS to drive urgency when a public exploit exists.