| Title | Zylon AI PrivateGPT 1.0.0/1.0.1/65b9b2b6 Server-Side Request Forgery (CWE-918) |
|---|
| Description | Title: Unauthenticated SSRF in UriArtifact affects artifact conversion and ingestion
Summary
PrivateGPT UriArtifact.value reaches load_file_from_uri() without destination validation. HTTP(S) values are fetched with requests.get(..., allow_redirects=True), permitting direct and redirect-based requests to loopback, private, link-local, and reserved addresses. Authentication is disabled in the default configuration.
On current main commit 65b9b2b6b880a607ebf53cf4f2ac023ff9f5a0e0, /v1/artifacts/convert parses fetched responses and returns parsed data through ConvertResponse.content. The ingestion endpoints also use the same loader.
Affected versions
The vulnerable network loader was verified in release tags v1.0.0 (7595d25a4c9d71befe04882c93272efa19ebf97a), v1.0.1 (88d7e259a455625796e3d5cd829c7de78f076231), and current main commit 65b9b2b6b880a607ebf53cf4f2ac023ff9f5a0e0. The newer /convert direct-response path was confirmed by source analysis on current main and was not present in the two release tags.
Affected code
- private_gpt/server/ingest/uri_loader.py: _load_file_from_url() performs unrestricted requests.get(url, allow_redirects=True, timeout=timeout, stream=True).
- private_gpt/server/utils/artifact_input.py: UriArtifact.to_binary_content() passes attacker-controlled self.value to load_file_from_uri().
- private_gpt/server/ingest/convert_router.py: convert_content() calls body.input.to_binary_content() and returns parsed content in ConvertResponse.
- private_gpt/server/ingest/ingest_router.py: /v1/artifacts/ingest accepts UriArtifact input.
- settings.yaml: server.auth.enabled defaults to false.
Safe reproduction
The exact loader functions from the analyzed source were dynamically executed against a controlled HTTP service bound to 127.0.0.1:18766. No cloud metadata or third-party private service was queried.
The controlled service returned the marker PRIVATEGPT_SSRF_PROOF_65b9b2b6. load_file_from_uri("http://127.0.0.1:18766/internal-proof", max_bytes=1024).read() returned:
SSRF bytes: b'PRIVATEGPT_SSRF_PROOF_65b9b2b6'
SSRF confirmed: True
The complete reproducible PoC was supplied to the vendor in the private GitHub advisory.
Impact
An unauthenticated attacker in the default configuration can cause the PrivateGPT process to issue GET requests to services reachable from the server, including loopback, private networks, and link-local addresses. Depending on deployment and response format, this may allow internal service enumeration, access to unauthenticated internal APIs, cloud metadata access, state-changing GET requests, or response disclosure through /v1/artifacts/convert. Redirects are followed without revalidation.
Limitations and accuracy
The SSRF sink was dynamically reproduced and the public endpoint call chain was verified from source. The complete FastAPI server was not run in the research environment because it had Python 3.14.6 while the project requires Python >=3.11,<3.12 and application dependencies were absent. Therefore this submission does not claim an observed end-to-end HTTP response from /convert.
A related arbitrary local-file-read issue was already publicly reported as GitHub issue #2269. That LFI is not claimed here as a new finding. This submission concerns unrestricted HTTP SSRF and the newer conversion response path.
Suggested classification
CWE-918: Server-Side Request Forgery. Conservative suggested vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Maintainers/moderators should adjust impact metrics for representative deployment conditions.
Remediation
Restrict public URI artifacts to HTTP/HTTPS, resolve and reject every non-global IPv4/IPv6 destination, disable automatic redirects or validate every redirect target, and bind validated DNS resolution to the connection to prevent rebinding. Local-file loading should be moved to a separate internal-only artifact type. Authentication should be enabled by default.
Vendor coordination
The vendor was contacted before this submission through GitHub Private Vulnerability Reporting. Private advisory: GHSA-8294-hj7x-42g2. The report is currently embargoed and visible to the repository maintainers.
References
https://github.com/zylon-ai/private-gpt
https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2
https://github.com/zylon-ai/private-gpt/blob/65b9b2b6b880a607ebf53cf4f2ac023ff9f5a0e0/private_gpt/server/ingest/uri_loader.py
https://github.com/zylon-ai/private-gpt/blob/65b9b2b6b880a607ebf53cf4f2ac023ff9f5a0e0/private_gpt/server/utils/artifact_input.py
https://github.com/zylon-ai/private-gpt/blob/65b9b2b6b880a607ebf53cf4f2ac023ff9f5a0e0/private_gpt/server/ingest/convert_router.py
https://github.com/zylon-ai/private-gpt/issues/2269
|
|---|
| Source | ⚠️ https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2 |
|---|
| User | fernando viana (UID 101484) |
|---|
| Submission | 09/21/2026 02:04 (1 month ago) |
|---|
| Moderation | 10/24/2026 11:52 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426100 [Zylon PrivateGPT 1.0.0/1.0.1 URI Artifact Loader uri_loader.py load_file_from_uri value server-side request forgery] |
|---|
| Points | 20 |
|---|