PT-2026-44979 · Fastgpt · Fastgpt

C121914Yu · Published 2026-05-29 · Updated 2026-05-30 · CVE-2026-44285

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.0-beta1

Description An authenticated attacker can bypass the global isInternalAddress network protection to make arbitrary HTTP GET requests to internal network services. This occurs due to an incomplete fix in the dataset preview endpoint "/api/core/dataset/file/getPreviewChunks" when the externalFile data import type is used. This is a Server-Side Request Forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 4.15.0-beta1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44285

Affected Products

Fastgpt

References · 3

• 🔥 https://github.com/labring/FastGPT/security/advisories/GHSA-c65v-7vx6-f8m3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44285 · Security Note
• https://twitter.com/VulmonFeeds/status/2060537985360130111 · Twitter Post