Vulnerability · Published May 16, 2024 · Assigned by @huntr_ai
CVE-2024-3403Local File Inclusion in imartinez/privategpt
High 7.5
In plain English
A high-severity path traversal in imartinez/privategpt from imartinez. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| imartinez | imartinez/privategpt | unspecified – through latest |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N