The vulnerability allows any authenticated user to perform unauthorized deletions of other users' chat histories and critical system files by exploiting a path traversal flaw. This can lead to significant data loss and denial of service, as essential files like config.json can be deleted, rendering the service inoperable.

An attacker can exploit this vulnerability by sending a crafted POST request to the server, specifying the path of the file or chat history they wish to delete. For example, by targeting the config.json file, the attacker can cause a denial of service by preventing any user from authenticating to the service.

All users of ChuanhuChatGPT version 20240410 are affected, as any authenticated user can exploit this vulnerability to delete other users' data and critical system files.