CVE-2024-5278: gaizhenbiao/chuanhuchatgpt · Unrestricted File Upload
Affects gaizhenbiao/chuanhuchatgptSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
European organizations should implement strict validation and sanitization of all uploaded files, enforcing allowlists for file extensions and MIME types. Specifically, disallow executable file types such as .py, .exe, .js, and .html unless explicitly required and safely handled. Employ server-side scanning of uploaded files for malicious content using antivirus or specialized security tools. Restrict upload permissions to authenticated and authorized users only, and implement rate limiting and monitoring on the /upload endpoint to detect anomalous activity. Consider deploying web application firewalls (WAFs) with rules to block suspicious file uploads and payloads. If possible, isolate the upload functionality in a sandboxed environment to limit the impact of any successful exploit. Regularly update the gaizhenbiao/chuanhuchatgpt software and monitor vendor advisories for patches addressing this vulnerability. Finally, conduct security awareness training to reduce the risk of social engineering attacks that might facilitate malicious uploads.
Description
gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` endpoint. Specifically, the `handle_file_upload` function does not sanitize or validate the file extension or content type of uploaded files, allowing attackers to upload files with arbitrary extensions, including HTML files containing XSS payloads and Python files. This vulnerability, present in the latest version as of 20240310, could lead to stored XSS attacks and potentially result in remote code execution (RCE) on the server hosting the application.