Executive brief
NextChat (formerly ChatGPT Next Web) is a popular web-based interface for AI assistants. A security vulnerability in its 'Artifacts' feature allows remote attackers to trick the server into making unauthorized requests to internal or external services. This could lead to the exposure of sensitive Cloudflare API tokens, potentially allowing an attacker to take control of the website owner's Cloudflare infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `app/api/artifacts/route.ts` endpoint of NextChat. The application takes an unvalidated `id` query parameter and concatenates it into a backend fetch request targeting the Cloudflare KV API. Because the fetch API performs URL path normalization, an attacker can provide directory traversal sequences (e.g., `../../`) to escape the intended KV namespace and reach the Cloudflare API root. Since the server automatically attaches the `CLOUDFLARE_KV_API_KEY` to these requests, an attacker can invoke arbitrary Cloudflare API functions with the server's privileges. This vulnerability is exploitable remotely without authentication. As of the advisory date, no official patch has been confirmed by the maintainers.
Affected products
- ChatGPTNextWeb NextChat <= 2.16.1
Timeline
- 2026-04-06: other: Vulnerability discovered and documented in private gist
- 2026-04-27: disclosed: Public disclosure of CVE-2026-7178
- 2026-04-27: advisory: VulDB entry published