Chainlit versions prior to 2.9.4 allow an authenticated client to trigger an arbitrary file read by sending a custom Element with a user-controlled path value. The server copies the referenced file into the attacker’s session; the resulting element identifier can be used to retrieve the file contents via the /project/file endpoint, enabling disclosure of any file readable by the Chainlit service.

Chainlit Chainlit – all releases before 2.9.4 are affected.

The flaw carries a CVSS score of 7.1 and a very low EPSS (<1%), indicating limited but possible exploitation. The attack requires authentication and path manipulation within the Element update flow, but once executed it yields unrestricted access to server files that the Chainlit process can read.