CVE-2024-10707: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in gaizhenbiao gaizhenbiao/chuanhuchatgpt
gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function.
CVE-2024-10707: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in gaizhenbiao gaizhenbiao/chuanhuchatgpt
Description
gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- @huntr_ai
- Date Reserved
- 2024-11-01T18:41:08.807Z
- Cvss Version
- 3.0
- State
- PUBLISHED
Threat ID: 68ef9b22178f764e1f470a30
Added to database: 10/15/2025, 1:01:22 PM
Last updated: 10/15/2025, 1:01:23 PM
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
CVE-2024-11171: CWE-770 Allocation of Resources Without Limits or Throttling in danny-avila danny-avila/librechat
HighCVE-2024-11137: CWE-639 Authorization Bypass Through User-Controlled Key in lunary-ai lunary-ai/lunary
HighCVE-2024-11042: CWE-73 External Control of File Name or Path in invoke-ai invoke-ai/invokeai
CriticalCVE-2024-10986: CWE-59 Improper Link Resolution Before File Access in binary-husky binary-husky/gpt_academic
HighCVE-2024-10955: CWE-1333 Inefficient Regular Expression Complexity in gaizhenbiao gaizhenbiao/chuanhuchatgpt
MediumActions
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.