The vulnerability allows an attacker to control the parameters of a file upload request and create files in arbitrary locations on the server. Because the upload size reported by the client is not validated, an attacker can falsify the file size to bypass monthly usage limits, potentially uploading far larger data than permitted. This can inflate billing figures, exhaust storage, and degrade performance, causing direct financial damage to the operator and offering an indirect denial of service to other users sharing the same subscription plan.

Products from LobeHub (lobehub:lobe-chat) running any version earlier than 1.143.3 are affected. The vulnerability exists in the file upload feature of the Knowledge Base interface.

The CVSS score of 5.7 indicates moderate severity; the EPSS score is less than 1%, suggesting a low probability of widespread exploitation. The issue is not listed in the CISA KEV catalog. Exploitability requires that an attacker has access to the upload interface or can intercept traffic to manipulate request parameters. Successful exploitation would enable arbitrary file creation, quota circumvention, and potential service disruption.