CVE-2024-5982

The problem occurs in three places: the load_chat_history function in modules/models/base_model.py allows uploading arbitrary files to the server through unsecured upload, which can lead to RCE. The get_history_names function in utils.py allows creating arbitrary directories in the file system. The load_template function in utils.py can be exploited to read the first column of CSV files, leading to data disclosure. The common cause of all three problems is improper sanitization of user input data before combining them with directory paths using os.path.join.

An unauthenticated remote attacker can upload arbitrary files to the server (which can consequently lead to RCE), create arbitrary directories in the file system, and read data from CSV files stored on the server.

Apply patches available from the vendor according to references — the fix was introduced in commit 952fc8c3cbacead858311747cddd4bedcb4721d7 in the project's GitHub repository

Latest version of the gaizhenbiao/chuanhuchatgpt application (versions specified in vendor references)