CVE-2026-23835: @lobehub/chat Arbitrary File Upload Vulnerability Due to Improper Authorization
Summary
CVE-2026-23835: LobeHub Vulnerable to Improper Authorization in Presigned Upload. Affects @lobehub/chat versions < 1.143.3. Fixed in 1.143.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @lobehub/chat package is a component of the LobeHub platform, which facilitates chat functionalities and file uploads within its Knowledge Base feature. This package allows users to upload files for sharing and storage. However, it has been identified that the file upload feature does not adequately validate the integrity of upload requests, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the lack of proper authorization checks in the file upload feature of the Knowledge Base. Users can intercept and modify request parameters, enabling them to upload files to unintended paths and manipulate file size reports. This can lead to the upload of excessively large files, bypassing storage limits and potentially causing financial discrepancies and service degradation. The vulnerability is classified under CWE-73, which pertains to improper authorization.
How To Fix
Minimum fixed version
1.143.3
This is the first release that contains the fix.
npm install @lobehub/chat@1.143.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the file upload feature until the package is updated. Additionally, implementing server-side validation for file uploads can help mitigate risks associated with unauthorized file uploads.
Conclusion
The CVE-2026-23835 vulnerability in the @lobehub/chat package poses significant risks due to improper authorization in file uploads. Users are advised to update to the latest version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for @lobehub/chat →
FAQ
CVE-2026-23835 is a vulnerability in the @lobehub/chat package that allows for arbitrary file uploads due to improper authorization checks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized file uploads, financial discrepancies due to manipulated file sizes, and potential denial of service for legitimate users.
You can update the package by running the command: npm install @lobehub/chat@1.143.3 in your terminal.
Vulert is a monitoring tool that uses package-lock.json to alert users in real-time about open-source vulnerabilities in their software.
References
Related vulnerabilities
Recent vulnerabilities recorded for @lobehub/chat.
