CVE-2026-116000 | Zylon PrivateGPT 1.0.0/1.0.1 URI Artifact Loader uri_loader.py load_file_from_uri value server-side request forgery (GHSA-8294-hj7x-42g2)

October 24, 2026 Yanac

A vulnerability identified as critical has been detected in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery.

This vulnerability is cataloged as CVE-2026-116000. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More