CVE-2024-5982

CVE-2024-5982 is a critical path traversal flaw (CWE-22, CVSS 9.8) in gaizhenbiao/chuanhuchatgpt, an open-source ChatGPT web interface, caused by user input concatenated with directory paths via os.path.join without sanitization. It affects multiple features: the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads that can lead to remote code execution, get_history_names in utils.py permits arbitrary directory creation, and load_template in utils.py can leak the first column of CSV files. An attacker can trigger these over the network without authentication or user interaction (per the CVSS vector), gaining the ability to upload files, execute code, create directories, or read CSV data on the server. Anyone running the latest version of the project, including self-hosted instances and public deployments such as Hugging Face Spaces, is affected. Exploitation has not been confirmed in the wild, but a public proof-of-concept exists and the 31% EPSS (98th percentile) indicates elevated near-term exploitation risk.

What to do: Operators should upgrade Chuanhu ChatGPT to the latest patched release as soon as one is published and track the huntr advisory (https://huntr.com/bounties/5d5c5356-e893-44d1-b5ca-642aa05d96bb) for fix details, since no fixed version is specified in the available data. Until patched, validate and sanitize user-supplied path components before they are passed to os.path.join, restrict network exposure of self-hosted or Hugging Face Space deployments, and review logs and filesystems for unexpected uploaded files, created directories, or CSV template access. Not currently listed in CISA KEV, but the high EPSS warrants prioritized patching of internet-facing instances.