id: PYSEC-2024-113
modified: 2024-10-31T19:20:49.353218Z
published: 2024-10-29T13:15:00Z
aliases:
- CVE-2024-8143
details: In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue
  exists in the /file endpoint that allows authenticated users to access the chat
  history of other users. When a user logs in, a directory is created in the history
  folder with the user's name. By manipulating the /file endpoint, an authenticated
  user can enumerate and access files in other users' directories, leading to unauthorized
  access to private chat histories. This vulnerability can be exploited to read any
  user's private chat history.
affected:
- package:
    ecosystem: PyPI
    name: chuanhuchatgpt
    purl: pkg:pypi/chuanhuchatgpt
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b
    repo: https://github.com/gaizhenbiao/chuanhuchatgpt
  - type: ECOSYSTEM
    events:
    - introduced: "0"
  versions:
  - 3.2.5
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/71c5ea4b-524a-4173-8fd4-2fbabd69502e
- type: WEB
  url: https://huntr.com/bounties/71c5ea4b-524a-4173-8fd4-2fbabd69502e
- type: FIX
  url: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b