FastGPT CVE-2026-44285

Attacker must hold valid FastGPT credentials with permission to call the dataset import APIs (CVSS PR:L), and the target instance must be reachable over the network and accept the externalFile data import type at /api/core/dataset/file/getPreviewChunks. Exploitation is limited to HTTP GET requests (no arbitrary methods or bodies), which constrains impact to read-style SSRF and rules out write-based internal API abuse, and is further bounded by what the FastGPT backend's network position can actually reach - instances deployed with strict egress filtering or IMDSv2 enforcement materially reduce realistic impact. No user interaction is required (UI:N) and no non-default configuration is needed beyond enabling dataset functionality, which is core to the product.

CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects a network-reachable, low-complexity attack requiring only low-privilege authentication, with scope change and high confidentiality impact but no integrity or availability effect - consistent with a read-only SSRF that exfiltrates data from adjacent internal systems rather than tampering with them. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit identified at time of analysis, so weaponization pressure currently appears low; however, the bug is described as an 'incomplete fix' of a prior SSRF, which historically correlates with rapid follow-up research once the advisory is public. Real-world risk is highest for FastGPT deployments exposed to untrusted or self-registered users on cloud infrastructure where instance metadata services (IMDSv1) or internal admin planes are reachable from the application host.

An attacker who has signed up for or obtained a low-privileged account on a multi-tenant or internet-exposed FastGPT instance creates a dataset using the externalFile import type and supplies an internal URL (for example http://169.254.169.254/latest/meta-data/iam/security-credentials/ or http://localhost:6379/) as the file source. They then invoke /api/core/dataset/file/getPreviewChunks, which fetches the URL server-side past the bypassed isInternalAddress check and returns the response body as preview content, enabling reconnaissance and read-only exfiltration of internal HTTP-reachable services. No public exploit identified at time of analysis, but the attack is straightforward given the documented endpoint and import type.