CVE-2025-0188: gaizhenbiao/chuanhuchatgpt · Server-Side Request Forgery (SSRF)
Affects gaizhenbiao/chuanhuchatgptSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 41% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Mar 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubgaizhenbiao/chuanhuchatgptpkg:github/gaizhenbiao/chuanhuchatgptOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2025-0188, organizations should implement strict input validation and sanitization for any URLs processed by the gaizhenbiao/chuanhuchatgpt software to prevent malicious request construction. Network-level controls should restrict the server's ability to make outbound requests to internal or sensitive IP ranges, employing firewall rules or egress filtering. Deploy network segmentation to isolate critical internal services from application servers handling external inputs. Monitor logs and network traffic for unusual outbound requests or access patterns indicative of SSRF exploitation attempts. Where possible, update or patch the software once a fix is available from the vendor or community. Employ the principle of least privilege for service accounts running the application to limit the scope of potential exploitation. Additionally, consider implementing web application firewalls (WAFs) with SSRF detection capabilities and conduct regular security assessments focused on SSRF and related vulnerabilities.
Description
A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or further attacks such as port scanning and accessing metadata endpoints.