AI-FILE

AIfile aifile は、公開文書化された OpenAI Files API を使用して、従来の HTTP/S リスナーの代わりに jsonl ファイルを介してインプラントメッセージを交換する Mythic C2 プロファイルです。これは、OpenAI が公開ドキュメントで定義した Files API の動作に依存しています: https://developers.openai.com/api/docs/guides/file-inputs?api-mode=responses。 リスナーは /v1/files エンドポイントをポーリングして purpose=batch の...

CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2024-0453

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openaifiledeletecallback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above...