CVE-2024-5278

Katalog CVE

CVSS 6.1 · Medium EPSS 0,59%

Kerentanan Unrestricted Upload of File with Dangerous Type pada gaizhenbiao chuanhuchatgpt. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` endpoint. Specifically, the `handle_file_upload` function does not sanitize or validate the file extension or content type of uploaded files, allowing attackers to upload files with arbitrary extensions, including HTML files containing XSS payloads and Python files. This vulnerability, present in the latest version as of 20240310, could lead to stored XSS attacks and potentially result in remote code execution (RCE) on the server hosting the application.

Rincian

Terbit di NVD

6 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/ea821d86-941b-40f3-a857-91f758848e05 exploit · advisory pihak ketiga
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/22007a77f037c0cf76180f9b73a8d19e87dad02e