CVE-2026-7177

Katalog CVE

CVSS 7.3 · High EPSS 0,60%

Kerentanan Server-Side Request Forgery (SSRF) pada nextchat. Skor CVSS 3.1 7.3 (High) menurut vuldb.com.

Deskripsi (NVD)

A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]/[...path]/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

27 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/da6b00024f5b7e1d4fa0658c19b77fbf exploit · advisory pihak ketiga
• https://vuldb.com/submit/797645 exploit · advisory pihak ketiga
• https://vuldb.com/vuln/359779 advisory pihak ketiga · vdb entry
• https://github.com/ChatGPTNextWeb/NextChat/ product
• https://github.com/ChatGPTNextWeb/NextChat/issues/6742 issue tracking
• https://vuldb.com/vuln/359779/cti permissions required