Media

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnera

Publicada: 20.03.2025
Actualizado: 11.10.2026 12:19

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	chuanhuchatgpt	<= 2024-09-25	sin corrección

Referencias

https://huntr.com/bounties/98fdedea-6ad0-4157-b7d2-ae71c9786ee8

Puntuación CVSS 6.5/10

Vector CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE): -
Plataforma: Python (PyPI)
Paquete: chuanhuchatgpt
Publicada: 20.03.2025
Actualizado: 11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2025-93 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: chuanhuchatgpt

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (21) en el archivo

Entradas en total: 21
Primera → última: 04.2024 03.2025
Sin corrección: 21
Explotada en ataques: 0

Distribución por gravedad

Crítica 4
Alta 9
Media 8

Divulgaciones por año

2024: 12
2025: 9
2026: 0

20.03.2025

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the

Alta · 8.1 CVE-2024-9216 <= 2024-12-04 sin corrección
20.03.2025

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and

Alta · 8.8 CVE-2024-8613 <= 20240802 sin corrección
20.03.2025

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnera esta entrada

Media · 6.5 CVE-2024-10707 <= 2024-09-25 sin corrección
20.03.2025

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although

Alta · 7.5 CVE-2024-10650 <= 20240918 sin corrección
29.10.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a m

Alta · 7.5 CVE-2024-7807 todas las versiones sin corrección
29.10.2024

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches

Alta · 7.5 CVE-2024-7962 todas las versiones sin corrección
31.07.2024

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.j

Crítica · 9.1 CVE-2024-6255 todas las versiones sin corrección
10.07.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to unc

Crítica · 9.1 CVE-2024-6037 <= 20240410 sin corrección
10.07.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unr

Crítica · 9.1 CVE-2024-6036 <= 20240410 sin corrección
27.06.2024

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any fi

Alta · 7.5 CVE-2024-6090 <= 20240410 sin corrección
27.06.2024

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py

Alta · 7.5 CVE-2024-6038 <= 20240410 sin corrección
27.06.2024

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attack

Crítica · 9.8 CVE-2024-5822 <= 20240410 sin corrección
16.05.2024

A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to impro

Alta · 7.5 CVE-2024-4321 <= 20240310 sin corrección
10.04.2024

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated ver

Alta · 7.5 CVE-2024-2217 <= 20240121 sin corrección

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación