CVE-2024-6090

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any files ending in `.json` on the target system, leading to a denial of service as users are unable to authenticate.

Score

CVSS 3.0 7.5 High

Status

Modified - security@huntr.dev

Published

2024-06-27

Last modified

2025-10-15

Weaknesses

CWE-22

Affected products

• Chuanhuchatgpt (Gaizhenbiao)
• Gaizhenbiaochuanhuchatgpt (Gaizhenbiao)

References

• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/526c615c437377ee9c71f866fd0f19011910f705
• https://huntr.com/bounties/bd0f8f89-5c8a-4662-89aa-a6861d84cf4c