CVE-2026-7845: Hash collision in Langchain-Chatchat lets attackers swap pasted images

A weak-hash flaw in Langchain-Chatchat up to 0.3.1.3 lets an adjacent attacker overwrite pasted images by colliding MD5 hashes computed from PIL.Image.tobytes. No vendor patch has shipped.