| शीर्षक | PromtEngineer localGPT Latest (commit: 4d41c7d) Arbitrary File Read |
|---|
| विवरण | A critical vulnerability chain exists in localGPT's RAG (Retrieval-Augmented Generation) system that allows any unauthenticated attacker to read arbitrary files from the server and extract their complete contents through the web interface. The vulnerability combines two separate flaws:
By chaining these vulnerabilities, an attacker can:
Read sensitive configuration files containing passwords, API keys, and database credentials
Extract user data and system information
Access AWS credentials, SSH keys, and other secrets
Perform all actions without any authentication
This is a zero-click, pre-authentication remote code execution equivalent that leads to complete system compromise. |
|---|
| स्रोत | ⚠️ https://github.com/August829/CVEP/issues/10 |
|---|
| उपयोगकर्ता | Yu_Bao (UID 89348) |
|---|
| सबमिशन | 13/03/2026 03:53 AM (4 महीनों पहले) |
|---|
| संयम | 27/03/2026 02:49 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 353890 [PromtEngineer localGPT तक 4d41c7d1713b16b216d8e062e51a5dd88b20b054 Web Interface rag_system/api_server.py handle_index सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|