Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gaizhenbiao/chuanhuchatgpt

              main @ c020b2d
            

Fixes

CVEs

CRITICAL

Peak severity

76.2%

Coverage

Highlights

Path Traversal: 14 prior fixes. Scrutinize any change in this area.

modules/utils.py: most-fixed (10 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The application repeatedly failed to safely canonicalize and validate user-supplied file paths for chat history loading, writing, and deletion, permitting arbitrary file manipulation or inclusion on the server. Fixed paths must be validated with resolved, absolute path checks.

Auth Bypass: Critical administrative capabilities (like updating or restarting the application service) and individual user history directories were exposed due to missing validation checks against an explicit administrator roster or authenticated user identity state.

Path Traversal: Default configuration of Gradio allowed exposure of sensitive system files and application credentials. Restricting Gradio's file access through blocklists and local-file-serving allowlists was required to block unauthorized downloads.