ChatGPT file download flaw fixed, hackers could bypass access controls

A security researcher found a vulnerability in ChatGPT that let hackers bypass file access restrictions using prompt injection and path traversal techniques. The flaw was reported to OpenAI and has now been fixed.

When users upload files to ChatGPT, the system doesn't offer a direct download. The researcher discovered that by asking the AI to edit the file first, then requesting a download link under the pretext of accidental deletion, ChatGPT would return a valid URL, exposing internal interface paths. Attackers could then use path traversal to access content outside the target path.

Although limited by sandbox restrictions, the vulnerability couldn't access highly sensitive data directly but could serve as part of a larger attack chain. OpenAI has updated the download link generation process to fix the issue.