En bref
- CVE-2024-6255 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant chuanhuchatgpt, chuanhuchatgpt (gaizhenbiao).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 13.7%, plus élevée que 96.5% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
Description
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and ds_config_chatbot.json. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.
NVD description
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free