HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-5001 — A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e5...

Saturday, March 28, 2026 at 04:15 PM UTC·Source: NIST NVD

Updated: Friday, April 3, 2026 at 01:53 PM UTC

Executive Summary

A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is the function do_POST of the file backend/server.py. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. The

Analysis

A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is the function do_POST of the file backend/server.py. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 7.3. Published: 2026-03-28T16:15:58.260.

Indicators of Compromise (2)

SHA-1 (1)
4d41c7d1713b16b216d8e062e51a5dd88b20b054
VirusTotalAnyRunJoe Sandbox
CVE (1)
CVE-2026-5001
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Mar 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Inconsistent Privacy Labels Don't Tell Users What They Are Getting

Data privacy labels are a great idea for mobile apps, but the current versions just aren't good enough.

Dark Reading
MEDIUMVulnerability

LinkedIn secretely scans for 6,000+ Chrome extensions, collects data

A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for installed extensions and collect device data. [...]

BleepingComputer
MEDIUMVulnerability

FCC proposes $4.5 million fine for voice service provider hosting ‘suspicious’ foreign call traffic

Voxbeam’s actions allegedly led to “financial impersonation robocalls” that were made to American consumers “ using “non-compliant and long dormant accounts,” the FCC said.

The Record