Lobehub vulnerabilities

Products

• Lobe-chat 12
• Lobehub 9
• Lobe Chat 7

Newest

• destiny.gg chat LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile CVE-2026-120315 8.7 HighNovember 2, 2026
• lobehub LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu CVE-2026-85621 6.9 MediumSeptember 4, 2026
• lobehub lobe-chat lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload CVE-2026-72594 7.6 HighAugust 10, 2026
• lobehub LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations CVE-2026-59100 2.3 LowJuly 2, 2026
• lobehub LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search CVE-2026-59098 7.1 HighJuly 2, 2026
• lobehub LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl CVE-2026-59095 8.3 HighJuly 2, 2026
• lobehub LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes CVE-2026-58580 6.0 MediumJuly 2, 2026
• lobehub LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import CVE-2026-58578 7.1 HighJuly 2, 2026
• lobehub LobeHub: Unauthenticated SSRF in `/webapi/proxy` CVE-2026-54157 Fix available 9.0 CriticalJune 16, 2026
• lobehub LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) CVE-2026-42045 6.2 MediumMay 5, 2026
• lobehub LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header CVE-2026-39411 Fix available 5.0 MediumApril 8, 2026
• lobehub lobe-chat LobeHub Vulnerable to Improper Authorization in Presigned Upload CVE-2026-23835 Fix available 5.7 MediumJanuary 30, 2026
• lobehub lobe-chat Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion CVE-2026-23522 3.7 LowJanuary 19, 2026
• lobehub lobe-chat Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) CVE-2026-23733 6.4 MediumJanuary 18, 2026
• lobehub lobe-chat SSRF in lobehub/lobe-chat with native web fetch module CVE-2025-62505 Fix available 3.0 LowOctober 17, 2025
• lobehub lobe-chat, lobe chat +1 more lobe-chat has an Open Redirect CVE-2025-59426 Fix available 4.3 MediumSeptember 24, 2025
• lobehub lobe-chat, lobe chat +1 more Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages CVE-2025-59417 Fix available 6.8 MediumSeptember 18, 2025
• lobehub lobe-chat, lobe chat +1 more ssrf vulnerability in lobe-chat CVE-2024-32965 Fix available EPSS 26.1% 8.1 HighNovember 26, 2024
• lobehub lobe chat, lobe-chat +1 more Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) CVE-2024-47066 Public exploitFix available EPSS 11.9% 9.0 CriticalSeptember 23, 2024
• lobehub lobe-chat, lobe chat +1 more API Key Leak in lobe-chat CVE-2024-37895 Fix available 5.7 MediumJune 17, 2024
• lobehub lobe-chat, lobe chat +1 more lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability CVE-2024-32964 Fix available EPSS 53.0% 9.0 CriticalMay 10, 2024
• lobehub lobe chat, lobe-chat +1 more Lobe Chat unauthorized access to plugins CVE-2024-24566 Fix available 5.3 MediumJanuary 31, 2024