Skip to content
Fencer Vulns
high 8.2

CVE-2024-6255 in the critical feed json

Path Traversal in gaizhenbiao/chuanhuchatgpt

published 2024-07-31 2 y ago modified 2026-06-17 4 mo ago also PYSEC-2024-73 , EUVD-2024-0026

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
13.7%
EPSS 13.7% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

13.66% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi chuanhuchatgpt
all versions
 no fix listed

Affected products

  • gaizhenbiao gaizhenbiao/chuanhuchatgpt
  • gaizhenbiao chuanhuchatgpt

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.