A critical path traversal vulnerability in Chainlit allows unauthenticated remote attackers to perform unauthorized file system operations, including the recursive deletion of arbitrary directories.

The application fails to sanitize the sessionId parameter provided during socket.io connections. This lack of validation allows an unauthenticated attacker to inject path sequences, enabling them to escape the intended upload directory and manipulate or delete files and directories on the host system.

Successful exploitation of this vulnerability poses a severe risk to system integrity and availability. Because the service process may have broad permissions, an attacker can trigger the recursive deletion of critical directories, leading to significant service disruption, data loss, and potential system instability. With a CVSS score of 8.2, this vulnerability is classified as High severity, necessitating immediate attention to prevent malicious actors from compromising the host infrastructure.

Immediate Action: Update the Chainlit package to a version beyond 2.12.0 that incorporates the fix for path validation in the socket.io session handling.

Proactive Monitoring: Review application and system logs for anomalous socket.io connection attempts containing directory traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block incoming socket.io traffic containing suspicious path traversal characters in the sessionId field.

Public Exploit Available: No (exploit_available: false)

Given the potential for destructive file system operations, organizations running Chainlit should prioritize this update. Administrators must verify their current version and apply the vendor-provided patch immediately to eliminate the risk of unauthenticated directory deletion.