lobehub vulnerabilities

CVEs per yearBy the year they were published

1. 20245
2. 20253
3. 202614

Newest CVEs

• CVE-2026-120315

  LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile

  lobehub · chat

  High8.7
• CVE-2026-85621

  LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu

  lobehub · lobehub

  Medium6.9
• CVE-2026-72594

  lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

  lobehub · lobe-chat

  High7.6
• CVE-2026-59100

  LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations

  lobehub · lobehub

  Low2.3
• CVE-2026-59098

  LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

  lobehub · lobehub

  High7.1
• CVE-2026-59095

  LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

  lobehub · lobehub

  High8.3
• CVE-2026-58580

  LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes

  lobehub · lobehub

  Medium6.0
• CVE-2026-58578

  LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

  lobehub · lobehub

  High7.1
• CVE-2026-54157

  LobeHub: Unauthenticated SSRF in `/webapi/proxy`

  lobehub · lobehub

  Critical9.0
• CVE-2026-42045

  LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

  lobehub · lobehub

  Medium6.2