CVE-2024-5935 MEDIUM

CVE-2024-5935: CSRF Vulnerability in imartinez/privategpt

Vendor Imartinez
Product imartinez/privategpt
Weakness CWE-352 · CSRF
Published June 27, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.

Key dates

02Disclosure timeline

June 27, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23871 WordPress LSD Google Maps Embedder plugin <= 1.1 - CSRF to Stored XSS vulnerability CVE-2025-9949 Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery CVE-2025-57914 WordPress Deliver via Shipos for WooCommerce plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-58800 WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability CVE-2022-0191 Ad Invalid Click Protector (AICP) < 1.2.7 - Arbitrary Ban Deletion via CSRF