# ChatGPT File Download Flow Path Traversal / Local File Inclusion (LFI) via Guardrail Bypass Social Engineering

> Security researcher zer0dac disclosed a local file inclusion vulnerability in ChatGPT's sandboxed file download mechanism, chaining a guardrail-bypass social-engineering technique against the LLM itself with a path traversal payload appended after a legitimate filename to defeat inconsistent path normalization, ultimately reading /etc/passwd from the underlying container. OpenAI has since redesigned the URL download flow to remediate the issue.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1075
- **ID:** TL-2026-1075
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-5998

## Description

In June-July 2026, researcher zer0dac published a proof-of-concept demonstrating a four-step exploit chain against ChatGPT's Code Interpreter / Advanced Data Analysis file-download flow. Each ChatGPT conversation runs inside an ephemeral sandboxed Linux VM with a home directory of /home/sandbox and uploaded/generated files stored under /mnt/data. The platform exposes an internal backend endpoint, /backend-api/conversation/{id}/interpreter/download?message_id={id}&sandbox_path=/mnt/data/{filename}, which the ChatGPT frontend uses to generate signed download links for sandbox files.

The researcher first uploaded a dummy HTML file to establish a legitimate sandboxed file path. A direct request to re-download the file was refused by ChatGPT, which cited its temporary-storage deletion policy (a conversational/guardrail-level control rather than a server-side authorization check). To bypass this guardrail, the researcher requested an edit to the uploaded file, then falsely claimed the file had been 'accidentally deleted' and asked ChatGPT to regenerate a download link for it -- a social-engineering / prompt-manipulation technique against the assistant itself that caused ChatGPT to emit a fresh, valid signed download URL exposing the backend endpoint structure.

With a legitimate download URL in hand, the researcher crafted a path-traversal payload that avoided naive '../../../../etc/passwd'-style traversal (which the backend rejected outright) by instead appending the traversal sequence AFTER the legitimate sandbox filename: /mnt/data/test.html/../../../../etc/passwd. Because the download endpoint's path-normalization logic validated the leading path segment (matching an allowed sandbox file) before collapsing '../' sequences, the traversal was applied inconsistently: validation passed against the legitimate prefix, but path resolution ultimately escaped the /mnt/data sandbox root. Pasting the resulting URL directly into a browser returned the contents of /etc/passwd from the underlying container filesystem, confirming arbitrary local file read outside the intended upload sandbox.

The vulnerability was classified by the source publication under OWASP Top 10 for LLM Applications as LLM02:2025 (Sensitive Information Disclosure), since the guardrail bypass exploited the LLM's own conversational trust boundary as the initial access step before the classic web-application path-traversal vulnerability was reached. No CVE identifier was assigned. OpenAI has since redesigned the sandbox file download URL generation flow; specific technical remediation details were not disclosed publicly, consistent with OpenAI's coordinated vulnerability disclosure policy which restricts public disclosure of technical exploitation detail for issues reported through its Bugcrowd-hosted Security Bug Bounty program (active since April 2023) and its newer Safety Bug Bounty program (announced March 25, 2026) covering AI-abuse and agentic-safety issues.

While this specific instance was patched and no user data compromise beyond local test files (e.g. /etc/passwd on the researcher's own sandbox) was reported, the source article and independent research on ChatGPT's Code Interpreter sandbox (e.g. Check Point Research's February 2026 disclosure of a DNS-based covert exfiltration channel in the same Linux runtime, and a separate ChatGPT-on-WeChat path traversal flaw tracked as CVE-2026-5998) indicate the /mnt/data sandbox download flow and its Linux runtime are a recurring target class for LLM-application researchers. The technique documented here -- combining conversational guardrail bypass with inconsistent-normalization path traversal -- is flagged as a reusable building block against other AI platforms exposing file upload/download flows backed by a sandboxed execution environment.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1595 Active Scanning
- T1593 Search Open Websites/Domains
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1585 Establish Accounts
- T1204 User Execution

## Sources

- [ChatGPT File Download Flow Vulnerability](https://cybersecuritynews.com/chatgpt-file-download-flow-vulnerability/)
- [ChatGPT: Guardrail Bypass to LFI Vulnerability POC](https://infosecwriteups.com/chatgpt-sensitive-information-disclosure-llm02-2025-to-lfi-vulnerability-poc-4125f6f5a8f0)
- [ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime](https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/)
- [OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability](https://thehackernews.com/2026/03/openai-patches-chatgpt-data.html)
- [CVE-2026-5998: ChatGPT-on-WeChat Path Traversal Flaw](https://www.sentinelone.com/vulnerability-database/cve-2026-5998/)
- [ChatGPT Vulnerability Let Attackers Silently Exfiltrate User Prompts and Other Sensitive Data](https://cybersecuritynews.com/chatgpt-vulnerability/)
- [Announcing OpenAI's Bug Bounty Program](https://openai.com/index/bug-bounty-program/)
- [Introducing the OpenAI Safety Bug Bounty program](https://openai.com/index/safety-bug-bounty/)
- [Coordinated vulnerability disclosure policy](https://openai.com/policies/coordinated-vulnerability-disclosure-policy/)
- [Secrets of the ChatGPT Linux system](https://incoherency.co.uk/blog/stories/chatgpt-linux.html)
- [File Inclusion/Path traversal (HackTricks)](https://hacktricks.wiki/en/pentesting-web/file-inclusion/index.html)
- [Beyond dot dot slash: a practical guide to path traversal and arbitrary file read attacks](https://www.yeswehack.com/learn-bug-bounty/practical-guide-path-traversal-attacks)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1075