CVE-2026-7178: 
NextChat vulnerability analysis and mitigation

CVE-2026-7178 is a Server-Side Request Forgery (SSRF) vulnerability combined with path traversal in ChatGPTNextWeb NextChat (also known as ChatGPT-Next-Web) affecting versions up to and including 2.16.1. The flaw resides in the storeUrl function within app/api/artifacts/route.ts at the Artifacts Endpoint, where an unvalidated id query parameter is directly interpolated into a backend fetch request targeting the Cloudflare KV API. Disclosed on April 27, 2026, the vulnerability allows unauthenticated remote attackers to make arbitrary server-side requests, including leaking the server's privileged Cloudflare API token. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is improper input validation (CWE-918: SSRF, CWE-22: Path Traversal) in the GET /api/artifacts route handler. The vulnerable code directly concatenates the user-supplied id parameter into a fetch URL: fetch(`${storeUrl()}/values/${id}`, { headers: storeHeaders() }). Because the Node.js fetch API normalizes URL paths, an attacker can supply directory traversal sequences (e.g., ../../../../../../../user/tokens/verify) to escape the Cloudflare KV namespace path (/client/v4/accounts/{accountId}/storage/kv/namespaces/{namespaceId}/values/) and reach arbitrary Cloudflare API endpoints. Critically, the storeHeaders() function automatically attaches the server's CLOUDFLARE_KV_API_KEY as a Bearer token to every outbound request, meaning the traversed request is authenticated with the administrator's privileged credentials and the full response is returned to the attacker (GitHub Issue, PoC Gist).

Successful exploitation allows an unauthenticated remote attacker to invoke arbitrary Cloudflare API endpoints using the victim server's privileged CLOUDFLARE_KV_API_KEY. Depending on the token's scope, this can result in full Cloudflare account takeover, manipulation of DNS settings, reading of other KV namespaces, bypassing of proxy protections, and exposure of sensitive infrastructure secrets. The vulnerability affects confidentiality, integrity, and availability of both the NextChat application and the broader Cloudflare infrastructure managed by the affected account (GitHub Issue, PoC Gist).

A public proof-of-concept exploit (Python script and curl command) was published by researcher YLChen-007 on GitHub Gist alongside the issue report filed on April 7, 2026, prior to CVE assignment (PoC Gist). The exploit requires no authentication and no user interaction, making it trivially automatable. As of the time of reporting, there is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.045% (low probability of near-term exploitation) (Github Advisory). The project maintainers had not responded to the issue report at the time of disclosure.

1. Reconnaissance: Identify publicly accessible NextChat instances (versions ≤ 2.16.1) configured with Cloudflare KV storage (CLOUDFLARE_KV_API_KEY, CLOUDFLARE_KV_NAMESPACE_ID, CLOUDFLARE_ACCOUNT_ID environment variables set). Use search engines or Shodan to find exposed instances on port 3000 or standard web ports.
2. Identify the vulnerable endpoint: Confirm the /api/artifacts endpoint is accessible by sending a benign GET request (e.g., GET /api/artifacts?id=test).
3. Craft path traversal payload: Construct a payload with exactly 7 directory traversal segments to escape the Cloudflare KV namespace path and reach the Cloudflare API root. Example: id=../../../../../../../user/tokens/verify.
4. Send the exploit request: Issue the request using curl or a Python script:

   curl -i -s -k "http://<target>:3000/api/artifacts?id=../../../../../../../user/tokens/verify"

5. Receive authenticated Cloudflare API response: The server fetches the traversed Cloudflare API endpoint using its own privileged Bearer token and returns the response body directly to the attacker. A 400/401/403 response from Cloudflare confirms the token was transmitted and the traversal succeeded.
6. Enumerate and exploit Cloudflare resources: Use the leaked CLOUDFLARE_KV_API_KEY to enumerate DNS records, KV namespaces, or other Cloudflare resources, potentially achieving full account takeover depending on token scope (GitHub Issue, PoC Gist).

• Network: Unusual outbound HTTP requests from the NextChat server to api.cloudflare.com endpoints outside of normal KV operations (e.g., /client/v4/user/tokens/verify, /client/v4/accounts/*/zones, etc.); inbound GET requests to /api/artifacts with id parameters containing ../ sequences.
• Logs: Web server access logs showing requests to /api/artifacts?id= with URL-encoded or raw path traversal sequences (e.g., %2F..%2F, ../); HTTP response codes of 400, 401, or 403 returned to external clients from the artifacts endpoint (indicating Cloudflare API was reached).
• Application Behavior: Unexpected Cloudflare API calls appearing in server-side logs or network monitoring that do not correspond to legitimate artifact storage/retrieval operations; Cloudflare audit logs showing API token usage from the NextChat server IP for non-KV endpoints.

Users should upgrade ChatGPTNextWeb NextChat to a version beyond 2.16.1 as soon as a patched release is available; the GitHub Advisory confirms affected versions are 2.16.0 and 2.16.1 (Github Advisory). As an immediate workaround, restrict outbound network connections from the NextChat application server to only the specific Cloudflare KV API endpoints required for normal operation using firewall rules or egress filtering. Additionally, apply strict input validation and sanitization to the id parameter in app/api/artifacts/route.ts to reject any input containing path traversal sequences (../). Administrators should also rotate the CLOUDFLARE_KV_API_KEY if the instance was exposed, and scope the API token to the minimum required permissions (KV read/write only).

The vulnerability was reported by researcher YLChen-007 via a GitHub issue on April 7, 2026, with a detailed advisory and PoC published simultaneously on GitHub Gist. As of the disclosure date, the NextChat project maintainers had not responded to the issue report, which was noted in the CVE description and GitHub Advisory (Github Advisory, GitHub Issue). No significant broader media coverage or notable security community commentary beyond the initial disclosure has been identified.