EUVD-2026-92263
GHSA-rhg8-4whm-xj7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated attacker-controlled header with no UI gives AV:N/AC:L/PR:N/UI:N; SSRF yields limited C/I/A (L) with S:U consistent with the vendor's SC:N, though cloud-metadata reach could justify higher.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Server-side request forgery (CWE-918) in ChatGPTNextWeb NextChat up to and including 2.16.1 lets an unauthenticated, remote attacker who can reach the /api/proxy endpoint (the Proxy Fallback Handler) redirect the server's outbound HTTP requests to arbitrary hosts by supplying a crafted x-base-url header. Because the hostname is concatenated into the server-side fetch target without any validation against private, loopback, link-local, or cloud-metadata ranges, a successful attack can reach internal-only services or instance-metadata endpoints, with impact bounded by what the host's network position can actually reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the NextChat /api/proxy endpoint (the Proxy Fallback Handler) be network-reachable by the attacker; the attacker fully controls the x-base-url request header, which the vulnerable code concatenates directly into the server-side fetch target without validating the hostname against internal/private/metadata ranges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but medium-tier risk, not a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No released patched version is independently confirmed: the only fix is the upstream pull request https://github.com/ChatGPTNextWeb/NextChat/pull/6884, which awaits acceptance, so treat this as "upstream fix available (PR/commit); released patched version not independently confirmed" and track that PR (and its related issue https://github.com/ChatGPTNextWeb/NextChat/issues/6813) for merge and release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipula
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to
Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today