{"cve":"CVE-2024-6255","nvd":{"published":"2024-07-31T01:15:09.847","modified":"2026-06-17T08:17:38.487","status":"Modified","description":"A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":9.1},"cwes":["CWE-22"],"references":["https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82","https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82"],"products":["gaizhenbiao:chuanhuchatgpt"],"source":"nvd","synced_at":"2026-10-19T21:53:51.317825789+00:00"},"epss":{"cve":"CVE-2024-6255","score":0.13662,"percentile":0.96486,"date":"2026-10-31"},"kev":null,"osv":[{"id":"PYSEC-2024-73","url":"https://osv.dev/vulnerability/PYSEC-2024-73","summary":"","modified":"2024-08-27T15:41:59.449837Z","packages":[{"ecosystem":"PyPI","name":"chuanhuchatgpt","purl":"pkg:pypi/chuanhuchatgpt","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}