Zylon PrivateGPT CVE-2026-116000

Exploitation requires the target PrivateGPT 1.0.0/1.0.1 deployment to expose the URI Artifact Loader so that the load_file_from_uri function in private_gpt/server/ingest/uri_loader.py is reachable; the attacker then manipulates the 'Value' (URI) argument to coerce server-side requests. Per CVSS, this is remote and unauthenticated (PR:N, UI:N) with low attack complexity. Limiting factors: the specific trigger mechanics beyond manipulating the URI argument are not described in the available sources, impact is bounded to Low confidentiality/integrity/availability (no scope change to subsequent systems), and realistic exposure depends on the URI ingestion feature being network-accessible to untrusted users rather than restricted to trusted operators.

This is a moderate-severity, real-but-not-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but all three impact metrics are Low (VC:L/VI:L/VA:L), which caps the base score at 6.9 - consistent with SSRF where the attacker influences server-side requests rather than achieving direct code execution or full data compromise. The exploit-maturity flag E:P (proof-of-concept) aligns with the intelligence that a public PoC reference exists but is not verified as working exploit code, so this should not be treated as weaponized or actively exploited. There is no CISA KEV listing and no EPSS score was provided, so widespread automated exploitation cannot be confirmed from the data; the vuln.today decision label is 'this_month,' indicating prioritized but non-emergency remediation. A key gap: the vendor (Zylon) was contacted but did not respond, and no fixed version is listed in the available evidence, so remediation status is unverified. Net: a legitimate SSRF worth patching on a normal cycle, not a drop-everything emergency, with real risk gated by whether the URI Artifact Loader feature is exposed and by the limited (Low) technical impact.

A remote, unauthenticated attacker interacts with a PrivateGPT instance that exposes the URI Artifact Loader, submitting a crafted URI as the 'Value' argument to load_file_from_uri so the server issues an attacker-controlled request. This can be abused to reach internal-only services or metadata endpoints the attacker could not otherwise contact. A public PoC reference exists (a GitHub issue) but is not verified as working exploit code.