CVE-2024-6255

HIGH

Path Traversal in gaizhenbiao/chuanhuchatgpt

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6255 has a selected CVSS score of 8.2 (high).

Description

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

chuanhuchatgpt

Browse gaizhenbiao / chuanhuchatgpt

Default status: unknown

CVE List20240410affected

gaizhenbiao/chuanhuchatgpt

Browse gaizhenbiao / gaizhenbiao/chuanhuchatgpt

Default status: unaffected

CVE ListThrough latestaffected

References

2