CVE-2026-72594

Name of the Vulnerable Software and Affected Versions lobehub/lobe-chat versions prior to 2.2.14

Description A stored cross-site scripting (XSS) issue exists where a low-privileged authenticated user can inject arbitrary JavaScript into the application. This occurs because the avatar upload handler determines the stored file extension and S3 content type based on the original filename instead of inspecting the actual file content. An attacker can upload a crafted SVG file as a user avatar containing a script element, which then executes in the browser of any user who views the attacker's profile or avatar.

Recommendations Update lobehub/lobe-chat to version 2.2.14 or later.