---
id: "CVE-2026-116000"
kind: "vulnerability"
aliases: ["CVE-2026-116000"]
title: "PrivateGPT: URI loader lets remote users trigger server-side request forgery"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "privategpt", "python", "rag", "self-hosted"]
not_affected_if: ["no-uri-ingest", "other-versions"]
published_at: "2026-10-25T03:16:26+00:00"
first_seen_at: "2026-10-25T04:02:13+00:00"
updated_at: "2026-10-25T04:03:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116000", "first_seen_at": "2026-10-25T04:02:13+00:00"}]
---

# PrivateGPT: URI loader lets remote users trigger server-side request forgery

Zylon PrivateGPT 1.0.0 and 1.0.1 have a server-side request forgery flaw in the load_file_from_uri function, which fetches files from URLs supplied in ingest requests. A remote attacker can make the server send requests to URLs of their choice, such as internal services, which can expose internal data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PrivateGPT version in the project's package metadata or deployment config, looking for `1.0.0` or `1.0.1`
- Confirm whether the ingest endpoint that calls private_gpt/server/ingest/uri_loader.py is reachable from untrusted networks

## Fix

- No vendor fix is stated in the sources; unknown
- Until a fixed release is confirmed, restrict network access to the PrivateGPT server and block outbound requests from it to internal addresses

## Timeline

- 2026-10-25T04:02:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116000

## From the sources

A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_