CVE-2026-85704Low· 3.7▾ TwilightPoC available

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score32/ 100 · Low

impact 20.4 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 4, 2026

Updated

Sep 10, 2026

CVSS

3.7

Vendor

ramon-victor

Product

freegpt-webui

CWE

CWE-362

Depth score

32 · Low

EPSS

0.27% · p20

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

decided 2026-09-10

Exploitation: poc
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 8.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 10 days

Sep 4, 2026Published
Disclosed via NVD
Sep 8, 2026EPSS first tracked
0.3%
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 14, 2026Public exploit observed
Exploit / PoC code exists

ramon-victor CWE-362 #nvd #cve.org #exploit-available

Affected

freegpt-webui 098db3dfeb41555c2ca9269df0f13e10ec1c35dc

Full technical detail▾

Overview

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This vulnerability only affects products that are no longer supported by the maintainer.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Sep 14, 2026Public exploit / PoC published
Sep 14, 2026Public exploit flag cleared
Sep 14, 2026Public exploit / PoC published
Sep 14, 2026Public exploit flag cleared
Sep 14, 2026Public exploit / PoC published
Sep 14, 2026Public exploit flag cleared
Sep 14, 2026Public exploit / PoC published
Sep 14, 2026Public exploit flag cleared
Sep 14, 2026Public exploit / PoC published
Sep 14, 2026Public exploit flag cleared
Sep 14, 2026Public exploit / PoC published
Sep 14, 2026Public exploit flag cleared

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available

← Back to feed