{"cve":"CVE-2024-5278","nvd":{"published":"2024-06-06T19:16:07.310","modified":"2026-06-17T08:15:36.010","status":"Modified","description":"gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` endpoint. Specifically, the `handle_file_upload` function does not sanitize or validate the file extension or content type of uploaded files, allowing attackers to upload files with arbitrary extensions, including HTML files containing XSS payloads and Python files. This vulnerability, present in the latest version as of 20240310, could lead to stored XSS attacks and potentially result in remote code execution (RCE) on the server hosting the application.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-434"],"references":["https://github.com/gaizhenbiao/chuanhuchatgpt/commit/22007a77f037c0cf76180f9b73a8d19e87dad02e","https://huntr.com/bounties/ea821d86-941b-40f3-a857-91f758848e05","https://huntr.com/bounties/ea821d86-941b-40f3-a857-91f758848e05"],"products":["gaizhenbiao:chuanhuchatgpt"],"source":"nvd","synced_at":"2026-10-19T21:51:20.603330631+00:00"},"epss":{"cve":"CVE-2024-5278","score":0.00591,"percentile":0.48256,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}