CVE-2024-3403 - CVE House
Back to Database
Status published High CVE-2024-3403

Local File Inclusion in imartinez/privategpt

Vulnerability Description

imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-3403

Credits & Attribution

No credits recorded in the NVD database.

References

More from imartinez

View All →
CVE-2024-8029
Stored XSS in imartinez/privategpt
Medium 4.7
CVE-2024-8018
Denial of Service (DOS) in imartinez/privategpt
High 7.5
CVE-2024-5936
Open Redirect in imartinez/privategpt
Medium 4.3
CVE-2024-5935
CSRF Vulnerability in imartinez/privategpt
Medium 5.4
CVE-2024-5186
Server Side Request Forgery (SSRF) in imartinez/privategpt
High 8.3

Affected Vendor

Affected Software

imartinez/privategpt
Vulnerable Versions:
unspecified

Timeline

Official Publish: May 16th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact