Vulnerabilities

TI-2026-06301 CVE-2026-7178 · GHSA-p35r-jg68-wccx

ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery

HIGH 70

A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00344 Published 2026-04-27 No fix listed CWE-918

TI-2026-06300 CVE-2026-7177 · GHSA-ff75-fg5h-fjx7

ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery

MEDIUM 64

A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00356 Published 2026-04-27 No fix listed CWE-918

TI-2025-32232 CVE-2025-50735 · GHSA-6p2w-vm5p-8648

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing…

HIGH 72

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authentic…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00915 Published 2025-11-03 No fix listed CWE-22

TI-2023-27194 CVE-2023-49785 · GHSA-qf3q-9f3h-cjp9

NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting

CRITICAL 90

NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83163 Published 2024-03-11 No fix listed CWE-79

Vulnerabilities

Filters

ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery

ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing…

NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting