CriticalVulnerabilityLLM-specific
CVE-2024-3234: gaizhenbiao/chuanhuchatgpt path traversal through outdated gradio component
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-3234
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 3.8%
Summary
The gaizhenbiao/chuanhuchatgpt application is vulnerable to path traversal because it uses an outdated gradio component. The gradio version it employs is susceptible to the flaw identified in CVE-2023-51449, letting unauthorized users bypass restrictions on the web_assets folder and read sensitive files such as config.json, which contains API keys. The issue affects the latest chuanhuchatgpt version prior to the fixed version released on 20240305.
Mitigation
The source states the issue is fixed in the version released on 20240305 but does not name that release beyond its date.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online