Home » Database

AVID-2026-R0926

Description

Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload (CVE-2021-44164)

Details

Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.

Reason for inclusion in AVID: CVE-2021-44164 describes an arbitrary file upload vulnerability in an AI chatbot system that allows remote code execution, with high impact (CVSS 9.8). This directly concerns software used in AI deployment/serving stacks and could compromise AI services, making it relevant to the general-purpose AI software supply chain. The advisory clearly indicates a vulnerability in a software component that would be used in AI pipelines, not hardware/firmware-only. Evidence includes CVSS vector, CWE-434, and documented exploitation path.

References

Affected or Relevant Artifacts

  • Developer: Chain Sea Information Integration Co., Ltd
  • Deployer: Chain Sea Information Integration Co., Ltd
  • Artifact Details:
TypeName
Systemai chatbot system

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score9.8
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-434CWE-434 Unrestricted Upload of File with Dangerous Type

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2021-12-20
  • Version: 0.3.3
  • AVID Entry