CVE-2024-5982
A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads, potentially leading to remote code execution (RCE). The get_history_names function in utils.py permits arbitrary directory creation. Additionally, the load_template function in utils.py can be exploited to leak the first column of CSV files. These issues stem from improper sanitization of user inputs concatenated with directory paths using os.path.join.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - security@huntr.dev
- Published
- 2024-10-29
- Last modified
- 2024-10-29
- Weaknesses
- CWE-22
Affected products
- Chuanhuchatgpt (Gaizhenbiao)
- Gaizhenbiao/chuanhuchatgpt (Gaizhenbiao)
- Gaizhenbiaochuanhuchatgpt (Gaizhenbiao)
References
- https://github.com/gaizhenbiao/chuanhuchatgpt/commit/952fc8c3cbacead858311747cddd4bedcb4721d7
- https://huntr.com/bounties/5d5c5356-e893-44d1-b5ca-642aa05d96bb
