NextChat
CVE-2026-7178
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to Artifacts Endpoint
-
ExploitInject internal URL in ID parameter
-
ExecutionstoreUrl issues unvalidated SSRF request
-
ImpactServer returns internal resource response to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Artifacts Endpoint (app/api/artifacts/route.ts) must be reachable over the network - this endpoint is a standard application component and is expected to be enabled by default in affected versions 2.16.0 and 2.16.1. No authentication is required per the CVSS 4.0 PR:N metric. The attacker must be able to send HTTP requests to the NextChat API, which is typically internet-exposed in self-hosted deployments. Exploitation impact is bounded by the server's outbound network policy: if egress to internal address ranges or cloud metadata services is blocked at the network layer, SSRF reach is reduced to probing externally reachable addresses only. No specific non-default configuration or user interaction is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates unauthenticated, low-complexity, network-accessible exploitation with no special attack prerequisites, making this trivially reachable against any exposed NextChat instance. The scored impact is partial (VC:L/VI:L/VA:L), and the overall score of 5.5 reflects limited confidentiality, integrity, and availability impact - SSRF probes internal resources but does not in itself guarantee full system compromise. EPSS at 0.04% (14th percentile) suggests low observed exploitation probability at time of analysis; however, SSVC explicitly rates the attack as automatable with a public POC present, which elevates practical risk above what EPSS alone implies. The absence of any vendor patch - the project has not responded to disclosure - means defenders cannot rely on upstream remediation and must apply compensating controls. The combination of PR:N, automatable SSVC rating, and publicly available exploit code makes this a meaningful operational priority despite the moderate CVSS score. |
| Exploit ScenarioDerived | An unauthenticated external attacker sends a crafted HTTP request to the NextChat Artifacts Endpoint with the ID parameter set to an internal resource URL such as http://169.254.169.254/latest/meta-data/. The storeUrl function passes the value without validation, causing the NextChat server to issue a GET request to the AWS instance metadata service and potentially return IAM credentials or other sensitive data in the HTTP response. A public proof-of-concept is available lowering the barrier to exploitation for any attacker with network access to the NextChat instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project was notified through GitHub issue #6741 but has not responded. Operators should apply the following compensating controls: restrict outbound network egress from the NextChat application server to block SSRF from reaching internal resources - specifically deny access to RFC 1918 address ranges, cloud metadata endpoints (169.254.169.254, fd00:ec2::254), and any internal services not explicitly required for application function, noting this may affect legitimate integrations. Deploy a WAF or API gateway rule that rejects or sanitizes user-supplied URL values in the ID parameter before they reach the Artifacts Endpoint. If the Artifacts feature is not actively used, disable or remove the /api/artifacts route entirely - this eliminates the attack surface but will break artifact-related functionality. Monitor the GitHub repository and issue tracker for patch availability, and reference the public POC at https://gist.github.com/YLChen-007/43252d45d75e8bdd2d45136fd6ffe8a5 to build detection signatures.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the storeUrl function within app/api/artifacts/route.ts, part of the NextChat Artifacts API endpoint. CWE-918 (Server-Side Request Forgery) identifies the root cause: user-supplied input in the ID parameter is used to construct or forward HTTP requests without adequate validation or sanitization. This permits the server process to make requests to arbitrary URLs - including RFC 1918 internal addresses, cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), or other network-internal services inaccessible from external clients. Affected CPE strings confirm the nextchat application package at versions 2.16.0 and 2.16.1 as vulnerable.
Know when Nextchat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable unauthenticated SSRF with no scope change; partial confidentiality and integrity impact from internal resource probing, no availability impact described.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1. This affects the function storeUrl of the file app/api/artifacts/route.ts of the component Artifacts Endpoint. This manipulation of the argument ID causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Affected Products (CPE)CVE.org
Server-side request forgery (CWE-918) in ChatGPTNextWeb NextChat up to and including 2.16.1 lets an unauthenticated, rem
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipula
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI
Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot
Exploit-DB