This vulnerability in PromtEngineer localGPT up to commit 4d41c7d1713b16b216d8e062e51a5dd88b20b054 exists in the do_POST function of backend/server.py, which improperly restricts file uploads. This flaw enables remote attackers to upload arbitrary files without authentication or user interaction. The vulnerability has been publicly disclosed with exploit code available. Due to the rolling release strategy of the product, exact affected or patched versions cannot be specified. The vendor has not provided any response or patch to date.

Successful exploitation allows remote attackers to upload arbitrary files to the server running localGPT, potentially leading to unauthorized code execution, data compromise, or service disruption. The vulnerability requires no privileges or user interaction and has a low attack complexity. The published exploit increases the likelihood of active exploitation, although no confirmed in-the-wild attacks are reported. The medium CVSS score reflects the moderate severity of the impact.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should monitor the vendor's channels for updates or fixes. Until a fix is released, consider restricting network access to the affected service to trusted users only or deploying compensating controls such as web application firewalls to detect and block unauthorized upload attempts.