repository icon
gaizhenbiao / chuanhuchatgpt Project repository

GUI for ChatGPT API and many LLMs. Supports agents, file-based QA, GPT finetuning and query with web search. All with a neat UI.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN38 DAYS

FIX

WITHIN962 DAYS

Stored XSS via markdown code block regex bypass in clean_text() method at ./modu...
alehdezp
pending
SSRF in ChuanhuAgent when use ask_webpage/summary_webpage tool
polaris-snowfall
self closed
Timing Attack to guess username and password (bypass https://huntr.com/bounties...
shino-337
pending
Authentication Bypass via Timing Attack to guess username and password
shino-337
self closed
CORS misconfiguration leading to unauthorized file upload & XSS
sonw-vh
pending
CORS Misconfiguration Vulnerability Leading to Application Takeover In ChuanhuCh...
superboy-zjc
pending
Reading other users chat history via the `load_chat_history` and `get_history_na...
williwollo
duplicate
Medium
Bypassing HTML tag removal filters leads to Stored XSS Vulnerability in Chat His...
redasb31
duplicate
Medium
Stored XSS in function upload
chucsse
duplicate
Critical
SSRF due to insufficient patch of CVE-2024-5822
mnqazi
Medium
•$75•CVE-2025-0188
Improper sanitization leads to stored XSS via html file upload in knowledge base
olivierlaflamme
duplicate
High
DoS by Sending Large Filename at File Upload Endpoint
mnqazi
Medium
•$75•CVE-2025-0191
LFI(Local file inclusion) by exploiting CVE-2024-4941
oicu0619
Medium
•$75•CVE-2024-10707
Any user can access delete other users chat history
oicu0619
High
•$450•CVE-2024-9216
bypass of bounties/e9eaaea9-5750-4955-9142-2f12ad4b06db
oicu0619
Medium
•$75•CVE-2024-9159
Leakage of Openai API Key
oicu0619
informative
High
Denial of Service (DoS): Insufficient Patch for CVE-2024-7807
mnqazi
High
•$450•CVE-2024-10650
Redos (Regular Expression Denial of Service)
oicu0619
Medium
•$75•CVE-2024-10955
Stored XSS via Chat History upload
oicu0619
Medium
•$75•CVE-2024-9107
clickjacking vulnerability
tharunavula
duplicate
Medium
Server Side Request Forgery using CVE-2024-4325
mnqazi
self closed
Stored XSS via Chat message
aftersnows
duplicate
High
Any user can Access/copy/delete other users chat history
mnqazi
High
•$450•CVE-2024-8613
Privilege escalation from unescaped environment variables
ndren
informative
High
stored xss caused by the file parameter opening a file in different file paths
quxaa
duplicate
Medium
open redirection through file upload
quxaa
duplicate
None
huntr-helper
duplicate
None
huntr-helper
duplicate
None
Memory Corruption via Large Pixels
royalaholddelhaize1
spam
Chat history of any user can be leaked in /file endpoint
winters0x64
Medium
•$75•CVE-2024-8143
Arbitrary File Read via Insufficient Validation in Load Prompt template
web-hacker-team
High
•$450•CVE-2024-7962
Stored XSS via Knowledge Base File upload
web-hacker-team
duplicate
Medium
•CVE-2024-7821
Arbitrary folder creation, at any location of the Server, including C:/ (root) d...
mnqazi
informative
Medium
DOS in multipart boundry while uploading the file
mnqazi
High
•$450•CVE-2024-7807
test
tuna18dv
self closed
Stored XSS via Chat History upload
mnqazi
High
•$900•CVE-2024-6035
Arbitrary file creation, leads to overwrite all json files including config.json
mnqazi
duplicate
Critical
The server can be restarted by any user, any number of times disrupting the whol...
mnqazi
High
•$450•CVE-2024-6036
Arbitrary folder creation, at any location of the Server, including C:/ (root) d...
mnqazi
High
•$450•CVE-2024-6037
ReDoS vulnerability in the history search feature
szarny
duplicate
High
Unauthorized upload arbitrary files
tuna18dv
informative
High
ReDoS Vulnerability in Chat History Filtering via Regular Expression Injection
fatmo666
High
•$450•CVE-2024-6038
Unauthorized Access Exposing User Chat Histories
fatmo666
informative
Medium
Path Traversal Causes Arbitrary Upload (RCE), Arbitrary Directory Creation, and...
fatmo666
Critical
•$900•CVE-2024-5982
Arbitrary File Deletion via Directory Traversal in JSON File Handling
mnqazi
High
•$450•CVE-2024-6255
Deleting Other User's Chat History
pinkdraconian
High
•$450•CVE-2024-6090
Frameable response (potential Clickjacking)
mnqazi
informative
Medium
File Overwrite Vulnerability Leads to Configuration File Tampering and Denial of...
qhaoduoyu
Medium
•$75•CVE-2024-5823
Chuanhu's upload processing interface has ssrf vulnerability
qhaoduoyu
High
•$450•CVE-2024-5822
Any user can access the chat history of any other user without any interaction
mnqazi
High
•$450•CVE-2024-4520
Open Redirect Due to improper handling of input.
mnqazi
duplicate
Medium
CSRF on file upload leads to stored XSS
mnqazi
duplicate
High
CSRF allows attacker to upload large files to victim
h2oa
informative
Medium
GET-Based Open Redirect
h2oa
informative
Medium
Store XSS via upload file
nduy2110
Medium
•$75•CVE-2024-8400
Timing Attack to guess password
rook1337
High
•$450•CVE-2024-5124
File Upload Vulnerability may leads to RCE
mohamedabdelhady933
Medium
•$75•CVE-2024-5278
Local File Inclusion (LFI)
mvlttt
High
•$450•CVE-2024-4321
Unrestricted file upload leads to XSS
hiu240900
duplicate
High
xss bug via uploaded file
ranjit-git
spam
LFI due to the use of outdated components
ouxs-19
Critical
•$900•CVE-2024-3234
Improper Certificate Validation in YuanAPI
ehtec
informative
High
Insecure model output handling leads to XSS vulnerability
dastaj
Medium
•$75•CVE-2024-3402
Unauthorized access to chat history
dastaj
Medium
•$75•CVE-2024-3404
Unauthorized access to config.json file
dastaj
High
•$450•CVE-2024-2217