TI-2024-25750 Aliases CVE-2024-38514

NextChat Server-Side Request Forgery (SSRF)

MEDIUM 45CWE-918Published 2024-06-28 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02168 82nd percentileScored 2026-11-07

Fix Fixed ChatGPT-Next-Web (ChatGPTNextWeb): 2.12.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ChatGPTNextWeb	ChatGPT-Next-Web	before 2.12.4	2.12.4	Patch available	CNA

ChatGPT-Next-Web VendorChatGPTNextWeb Affected before 2.12.4 Fixed in 2.12.4 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:chatgptnextweb:nextchat::::::::	—	—	—

cpe:2.3:a:chatgptnextweb:nextchat:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ChatGPT-Next-Web (ChatGPTNextWeb) Fixed in 2.12.4

Timeline

2026-10-02 Threatist record created from CVE-2024-38514

References

Other 2

TI-2023-27194 NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting CVSS 3.1CRITICAL 9.8
TI-2026-56977 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure CVSS 4.0HIGH 8.7
TI-2025-32232 Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing… CVSS 3.1HIGH 7.5
TI-2026-67707 Server-side request forgery in NextChat Proxy Fallback proxyHandler CVSS 4.0MEDIUM 6.9
TI-2026-06726 ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization CVSS 4.0MEDIUM 6.9
TI-2026-06301 ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery CVSS 4.0MEDIUM 6.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences