CVE-2023-49785: NextChat unauthenticated SSRF and reflected XSS in chat UI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and very high EPSS make this an urgent exposure if the application is internet-facing.

What it is

NextChat (ChatGPT-Next-Web) versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. The SSRF allows reading and writing to internal HTTP endpoints via POST, PUT and other methods, and the application can be abused as an open proxy. No patch was available at publication, so exposure to the public internet is the main risk.

Impact

An unauthenticated attacker can reach internal HTTP services for read and write operations, and can mask their source IP by proxying traffic through the host. The XSS component can execute script in a victim's browser context.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The SSRF is triggered through the application's HTTP handling, while the XSS requires a victim to load crafted content.

Exploitation

Public exploit write-ups are referenced and EPSS is very high (0.83163, 99.66th percentile), indicating likely active interest. The CVE is not listed in CISA KEV, so confirmed in-the-wild exploitation is not established by this record.

What to do

• Apply the fix referenced in the project's pull request 4285 if it resolves the issue for your version; otherwise treat 2.11.2 and prior as unpatched.
• Do not expose NextChat directly to the public internet; place it behind authentication and a reverse proxy.
• Run the application on an isolated network segment with no access to internal services, metadata endpoints or other internal resources.
• Restrict outbound HTTP/HTTPS from the host to only required destinations to limit SSRF and open-proxy abuse.
• Sanitize and encode user-supplied content to reduce reflected XSS risk.

Detection

• Monitor application and proxy logs for requests to internal IP ranges, localhost, or cloud metadata addresses (169.254.169.254).
• Alert on unusual outbound POST/PUT requests originating from the NextChat host.
• Inspect for reflected script payloads in request parameters and responses tied to the chat interface.
• Baseline normal outbound destinations for the host and alert on new or high-volume egress.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.