Średnia

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnera

Ujawniono: 20.03.2025
Aktualizacja: 11.10.2026 12:19

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Python (PyPI)	chuanhuchatgpt	<= 2024-09-25	brak poprawki

Odnośniki

https://huntr.com/bounties/98fdedea-6ad0-4157-b7d2-ae71c9786ee8

Ocena CVSS 6.5/10

Wektor CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Słabość (CWE): -
Platforma: Python (PyPI)
Paczka: chuanhuchatgpt
Ujawniono: 20.03.2025
Aktualizacja: 11.10.2026 12:19

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2025-93 - PyPA Advisory Database; CC BY 4.0

Historia podatności: chuanhuchatgpt

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (21) w archiwum

Wszystkich wpisów: 21
Pierwsza → ostatnia: 04.2024 03.2025
Bez poprawki: 21
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 4
Wysoka 9
Średnia 8

Ujawnienia w latach

2024: 12
2025: 9
2026: 0

20.03.2025

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the

Wysoka · 8.1 CVE-2024-9216 <= 2024-12-04 brak poprawki
20.03.2025

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and

Wysoka · 8.8 CVE-2024-8613 <= 20240802 brak poprawki
20.03.2025

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnera ten wpis

Średnia · 6.5 CVE-2024-10707 <= 2024-09-25 brak poprawki
20.03.2025

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although

Wysoka · 7.5 CVE-2024-10650 <= 20240918 brak poprawki
29.10.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a m

Wysoka · 7.5 CVE-2024-7807 wszystkie wersje brak poprawki
29.10.2024

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches

Wysoka · 7.5 CVE-2024-7962 wszystkie wersje brak poprawki
31.07.2024

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.j

Krytyczna · 9.1 CVE-2024-6255 wszystkie wersje brak poprawki
10.07.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to unc

Krytyczna · 9.1 CVE-2024-6037 <= 20240410 brak poprawki
10.07.2024

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unr

Krytyczna · 9.1 CVE-2024-6036 <= 20240410 brak poprawki
27.06.2024

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any fi

Wysoka · 7.5 CVE-2024-6090 <= 20240410 brak poprawki
27.06.2024

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py

Wysoka · 7.5 CVE-2024-6038 <= 20240410 brak poprawki
27.06.2024

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attack

Krytyczna · 9.8 CVE-2024-5822 <= 20240410 brak poprawki
16.05.2024

A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to impro

Wysoka · 7.5 CVE-2024-4321 <= 20240310 brak poprawki
10.04.2024

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated ver

Wysoka · 7.5 CVE-2024-2217 <= 20240121 brak poprawki

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację