Arbitrary File Deletion via Directory Traversal in gaizhenbiao/chuanhuchatgpt

CVE-2024-6255

What is CVE-2024-6255?

A serious vulnerability exists in the JSON file handling mechanism of the Chuanhuchatgpt product by Gaizhenbiao. This flaw allows any authenticated user to delete JSON files on the server, posing a significant threat to the integrity of the application. The vulnerability stems from inadequate path validation, making it susceptible to directory traversal attacks. Attackers can exploit this issue to remove essential configuration files, such as config.json and ds_config_chatbot.json, jeopardizing the system's functionality and leading to potential data loss or corruption.

References