CVE-2024-6255

high · 8.2

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

8.2

CVSS

13.1%

EPSS (exploit prob.)

96th

EPSS percentile

2024-07-31

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
gaizhenbiao	chuanhuchatgpt	20240410

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82
https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-6255