A path traversal flaw in LobeHub Chat allows authenticated users to write arbitrary files by supplying unsanitized names to the writeTempFile() function. An attacker can create a file record with a traversal name, trigger document parsing, and overwrite critical application files such as startServer.js, leading to code execution or denial of service. The weakness is classified as CWE‑22.

The vulnerability affects all installations of LobeHub Chat with versions ranging from 1.84.26 up to but not including 2.1.49. Any instance of the lobehub:chat product within this version window is susceptible.

The CVSS score of 8.7 reflects a high severity risk. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, but the requirement of authenticated access means that compromised or insider accounts can exercise the exploit. Once the attacker writes malicious code to an application file, remote code execution is possible. The attack path is straightforward, involving creation of a traversal filename via file.createFile followed by document parsing. Given the high CVSS and the ease of exploitation, immediate action is warranted.