CVE-2024-5935

5.4 mediumEPSS 0.2%

Medium (5.4) in pribai privategpt. EPSS 0.2% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2024-06-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pribai:privategpt

References

https://huntr.com/bounties/b374f1c9-fa25-4b52-a34d-5153afd5a295
https://huntr.com/bounties/b374f1c9-fa25-4b52-a34d-5153afd5a295

Check your stack JSON