Chuanhuchatgpt Vulnerable to Path Traversal Attack Due to Outdated Gradio Component

CVE-2024-3234

What is CVE-2024-3234?

The ChuanhuchatGPT application, developed by Gaizhenbiao, is susceptible to a path traversal vulnerability stemming from its reliance on an outdated Gradio component. This flaw undermines the application's designed restrictions on user access to the 'web_assets' directory, allowing unauthorized entities to exploit the vulnerability. Adversaries can potentially gain access to sensitive configuration files, such as 'config.json', which contain critical API keys and other sensitive data. This issue is particularly pertinent for versions of ChuanhuchatGPT released before the patch on March 5, 2024, posing significant risks if unaddressed.

References