CVE-2026-105238

7.3 HIGHpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-918

Public exploit & PoC references

https://github.com/ChatGPTNextWeb/NextChat/
https://github.com/ChatGPTNextWeb/NextChat/issues/6813
https://github.com/ChatGPTNextWeb/NextChat/pull/6884

All references

https://github.com/ChatGPTNextWeb/NextChat/
https://github.com/ChatGPTNextWeb/NextChat/issues/6813
https://github.com/ChatGPTNextWeb/NextChat/pull/6884
https://vuldb.com/cve/CVE-2026-105238
https://vuldb.com/submit/975707
https://vuldb.com/vuln/413450
https://vuldb.com/vuln/413450/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-37278PoC
HIGHCVE-2023-54402PoC
MEDIUMCVE-2024-34319
UNSCOREDCVE-2026-0311
LOWCVE-2026-100104
MEDIUMCVE-2026-100251
MEDIUMCVE-2026-100257
MEDIUMCVE-2026-100279

Related by shared AI tags and CWE weakness class. Browse the full archive.