A flaw in the handle_index function of rag_system/api_server.py in PromtEngineer localGPT allows an attacker to obtain sensitive data by sending a specially crafted request to its web interface. The vulnerability reflects improper privilege management and information exposure and could reveal configuration details or other confidential content served by the API.

The affected component is the web interface of PromtEngineer localGPT. Any installation built from the commit 4d41c7d1713b16b216d8e062e51a5dd88b20b054 or earlier is vulnerable. Because the project uses a rolling release model, no explicit version numbers are available; a patched commit must be applied as soon as one is released.

The vulnerability carries a severity rating of 6.9, indicating moderate risk. No publicly available exploit probability statistic is present, and it is not listed in the Known Exploited Vulnerabilities catalog, but a public exploit demonstrates its feasibility. Attackers can trigger the information disclosure remotely by manipulating the API request without needing local privileges or authentication.