https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-4515.htmlhttps://patchthecve.com/cve/CVE-2025-4515.htmlWed, 17 Jun 2026 09:33:25 +0000MEDIUM 4.3: A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attachttps://patchthecve.com/cve/CVE-2024-8029.htmlhttps://patchthecve.com/cve/CVE-2024-8029.htmlWed, 17 Jun 2026 08:21:43 +0000MEDIUM 6.1: An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.https://patchthecve.com/cve/CVE-2024-8018.htmlhttps://patchthecve.com/cve/CVE-2024-8018.htmlWed, 17 Jun 2026 08:21:41 +0000HIGH 7.5: A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible. https://patchthecve.com/cve/CVE-2024-12063.htmlhttps://patchthecve.com/cve/CVE-2024-12063.htmlWed, 17 Jun 2026 06:58:58 +0000HIGH 7.5: A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large fhttps://patchthecve.com/cve/CVE-2024-4343.htmlhttps://patchthecve.com/cve/CVE-2024-4343.htmlWed, 17 Jun 2026 08:01:42 +0000CRITICAL 9.8: A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function tohttps://patchthecve.com/cve/CVE-2024-5936.htmlhttps://patchthecve.com/cve/CVE-2024-5936.htmlWed, 17 Jun 2026 08:16:57 +0000MEDIUM 6.1: An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability https://patchthecve.com/cve/CVE-2024-5935.htmlhttps://patchthecve.com/cve/CVE-2024-5935.htmlWed, 17 Jun 2026 08:16:56 +0000MEDIUM 5.4: A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.https://patchthecve.com/cve/CVE-2024-5186.htmlhttps://patchthecve.com/cve/CVE-2024-5186.htmlWed, 17 Jun 2026 08:15:22 +0000HIGH 7.2: A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically, https://patchthecve.com/cve/CVE-2024-3851.htmlhttps://patchthecve.com/cve/CVE-2024-3851.htmlWed, 17 Jun 2026 07:45:17 +0000MEDIUM 5.4: A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads. Attackers can exploit this vulnerability by uploading malicious HTML files, such as those containing JavaScript payloads, which are then executed in the contehttps://patchthecve.com/cve/CVE-2024-3403.htmlhttps://patchthecve.com/cve/CVE-2024-3403.htmlWed, 17 Jun 2026 07:44:11 +0000HIGH 7.5: imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to