This vulnerability in PromtEngineer localGPT up to commit 4d41c7d1713b16b216d8e062e51a5dd88b20b054 affects the handle_index function within the rag_system/api_server.py file of the Web Interface component. Remote attackers can exploit this flaw to cause information disclosure. The vulnerability requires no privileges, no user interaction, and has low complexity. The product is delivered via a rolling release, and no specific patched versions have been identified. The vendor was contacted but did not provide any response or remediation guidance. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and partial confidentiality impact.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information from the affected system. There is no indication of integrity or availability impact. The vulnerability can be exploited remotely without authentication or user interaction. The exploit has been publicly disclosed, but no known exploits in the wild have been reported. The medium severity score reflects the potential for sensitive information leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from PromtEngineer. Until a fix is released, consider restricting network access to the affected Web Interface component to trusted users only to reduce exposure.