CVE-2024-6255

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6255
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6255.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6255
Aliases
Published
2024-07-31T00:00:15.258Z
Modified
2026-07-15T01:48:59.889859691Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
Path Traversal in gaizhenbiao/chuanhuchatgpt
Details

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and ds_config_chatbot.json. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

Database specific 
{
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6255.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/gaizhenbiao/chuanhuchatgpt

Affected ranges

Type
GIT
Repo
https://github.com/gaizhenbiao/chuanhuchatgpt
Events
Introduced
c7592900ac7a785169c3db12e60c2654446642ec
Last affected
c7592900ac7a785169c3db12e60c2654446642ec
Database specific 
{
    "cpe": "cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:20240410:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "20240410"
        },
        {
            "last_affected": "20240410"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

Other
20240410

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6255.json"