CVE-2026-22218

CVE-2026-22218 is an arbitrary file read vulnerability affecting Chainlit versions prior to 2.9.4. An authenticated attacker can exploit this flaw by manipulating the element update flow to read any file accessible by the Chainlit service. Rated Medium severity with a CVSS score of 6.5, the vulnerability has a network attack vector, low attack complexity, and high confidentiality impact. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.