← Back to CVE List

CVE-2024-5982

Published: 2024-10-29T13:15Z
Last Modified: 2024-11-14T18:52Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads, potentially leading to remote code execution (RCE). The get_history_names function in utils.py permits arbitrary directory creation. Additionally, the load_template function in utils.py can be exploited to leak the first column of CSV files. These issues stem from improper sanitization of user inputs concatenated with directory paths using os.path.join. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt