NextChat
CVE-2026-7178
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated SSRF with no scope change; partial confidentiality and integrity impact from internal resource probing, no availability impact described.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1. This affects the function storeUrl of the file app/api/artifacts/route.ts of the component Artifacts Endpoint. This manipulation of the argument ID causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Technical ContextAI
The vulnerability resides in the storeUrl function within app/api/artifacts/route.ts, part of the NextChat Artifacts API endpoint. CWE-918 (Server-Side Request Forgery) identifies the root cause: user-supplied input in the ID parameter is used to construct or forward HTTP requests without adequate validation or sanitization. This permits the server process to make requests to arbitrary URLs - including RFC 1918 internal addresses, cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), or other network-internal services inaccessible from external clients. Affected CPE strings confirm the nextchat application package at versions 2.16.0 and 2.16.1 as vulnerable.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project was notified through GitHub issue #6741 but has not responded. Operators should apply the following compensating controls: restrict outbound network egress from the NextChat application server to block SSRF from reaching internal resources - specifically deny access to RFC 1918 address ranges, cloud metadata endpoints (169.254.169.254, fd00:ec2::254), and any internal services not explicitly required for application function, noting this may affect legitimate integrations. Deploy a WAF or API gateway rule that rejects or sanitizes user-supplied URL values in the ID parameter before they reach the Artifacts Endpoint. If the Artifacts feature is not actively used, disable or remove the /api/artifacts route entirely - this eliminates the attack surface but will break artifact-related functionality. Monitor the GitHub repository and issue tracker for patch availability, and reference the public POC at https://gist.github.com/YLChen-007/43252d45d75e8bdd2d45136fd6ffe8a5 to build detection signatures.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipula
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI
Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today