A flaw was discovered in the do_POST function of PromtEngineer localGPT’s backend/server.py. The function allows files to be uploaded without any access control or file‑type validation checks, and the CVE notes that the exploit can be carried out remotely and has already been published. Because an attacker can place arbitrary files on the server, this could potentially lead to the execution of malicious code, loss of confidentiality, or disruption of service – the severity aligns with CWE‑284 (Improper Access Control) and CWE‑434 (Unrestricted Upload of File).

The affected product is PromtEngineer localGPT, with the vulnerability present in all code versions up to commit 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The project uses a rolling‑release model, so a specific fixed version is not indicated, and any deployment that has not been updated after this commit is considered vulnerable.

With a CVSS score of 6.9 the issue is rated moderate to high severity. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The description states that the attack can be performed remotely, and an exploit has already been issued, meaning that an attacker could send a crafted POST request to the upload endpoint from an external network. The lack of a publicly offered mitigation from the vendor suggests that the risk remains until a new release or other containment measures are applied.