Lobehub Chat vulnerabilities

• destiny.gg chat LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile CVE-2026-120315 8.7 HighNovember 2, 2026
• lobehub lobe-chat lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload CVE-2026-72594 7.6 HighAugust 10, 2026
• lobehub lobe-chat LobeHub Vulnerable to Improper Authorization in Presigned Upload CVE-2026-23835 Fix available 5.7 MediumJanuary 30, 2026
• lobehub lobe-chat Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion CVE-2026-23522 3.7 LowJanuary 19, 2026
• lobehub lobe-chat Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) CVE-2026-23733 6.4 MediumJanuary 18, 2026
• lobehub lobe-chat SSRF in lobehub/lobe-chat with native web fetch module CVE-2025-62505 Fix available 3.0 LowOctober 17, 2025
• lobehub lobe-chat, lobe chat +1 more lobe-chat has an Open Redirect CVE-2025-59426 Fix available 4.3 MediumSeptember 24, 2025
• lobehub lobe-chat, lobe chat +1 more Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages CVE-2025-59417 Fix available 6.8 MediumSeptember 18, 2025
• lobehub lobe-chat, lobe chat +1 more ssrf vulnerability in lobe-chat CVE-2024-32965 Fix available EPSS 26.1% 8.1 HighNovember 26, 2024
• lobehub lobe chat, lobe-chat +1 more Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) CVE-2024-47066 Public exploitFix available EPSS 11.9% 9.0 CriticalSeptember 23, 2024
• lobehub lobe-chat, lobe chat +1 more API Key Leak in lobe-chat CVE-2024-37895 Fix available 5.7 MediumJune 17, 2024
• lobehub lobe-chat, lobe chat +1 more lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability CVE-2024-32964 Fix available EPSS 53.0% 9.0 CriticalMay 10, 2024
• lobehub lobe chat, lobe-chat +1 more Lobe Chat unauthorized access to plugins CVE-2024-24566 Fix available 5.3 MediumJanuary 31, 2024