CVE-2024-27564

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 40.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-05 · updated 2026-06-17
Weakness: CWE-918

Description

pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.

Affected products

Dirk1983 Chatgpt: 2023-05-23

References

https://github.com/dirk1983/chatgpt/issues/114
https://web.archive.org/save/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/README.md
https://web.archive.org/save/https://github.com/dirk1983/chatgpt/issues/114
https://web.archive.org/web/20250320031248/https://mm1.ltd/
https://web.archive.org/web/20250320032559/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/pictureproxy.php
https://github.com/dirk1983/chatgpt/issues/114

Get alerted when CVE-2024-27564 or the next vulnerability affects your stack