Impact

This vulnerability allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file.

Affected versions: ≤ 20230526

Patches

The vulnerability has been fixed in bfac445

Workarounds

Setting up access authentication can help mitigate the vulnerability.