CyberRota Analysis
AI-GeneratedThe gpt-crawler application, up to version 1.5.1, is vulnerable due to inadequate validation of the outputFileName parameter in the POST /crawl endpoint, enabling unauthenticated attackers to write arbitrary files to any filesystem path. This flaw allows attackers to overwrite existing files with malicious content from their own URLs, posing a significant risk to system integrity and data security. Organizations using this software should prioritize patching this vulnerability to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs.