PT-2024-25655 · Unknown · Imartinez/Privategpt

Published 2024-05-16 · Updated 2025-07-17 · CVE-2024-3403

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions imartinez/privategpt version 0.2.0

Description The issue allows attackers to read arbitrary files from the filesystem by exploiting a local file inclusion vulnerability. This can be achieved by manipulating file upload functionality to ingest arbitrary local files, which can then be retrieved or disclosed through the 'Search in Docs' feature or by querying the AI. Potential impacts include remote code execution, unauthorized access to private files, source code disclosure, and exposure of configuration files.

Recommendations For imartinez/privategpt version 0.2.0, as a temporary workaround, consider disabling the file upload functionality and restricting access to the 'Search in Docs' feature until a patch is available. Avoid using the AI query feature to retrieve or disclose local files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-3403

Affected Products

Imartinez/Privategpt

References · 4

• 🔥 https://huntr.com/bounties/7431d1dd-f014-4d4f-acb6-f97369ef3688 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3403 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3403 · Vendor Advisory
• https://t.me/cvenotify/129354 · Telegram Post