Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-85704

CVE-2026-85704LOW

ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   N   N   L    2.9   .0041   33.4     —

AFFECTED
  Product        Versions                                    Fixed
  freegpt-webui  098db3dfeb41555c2ca9269df0f13e10ec1c35dc –  —

TIMELINE
  Sep 4   Reserved by VulDB
  Sep 4   Published (CNA: VulDB)
  Sep 10  EXPLOIT PUBLISHED — CVE-2026-85704 (ramon-victor freegpt-webui). Public exploit reference added.

CWE-362 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

Description

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This vulnerability only affects products that are no longer supported by the maintainer.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 4, 2026	Reserved	Reserved by VulDB
September 4, 2026	Published	Published (CNA: VulDB)
September 10, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-85704 (ramon-victor freegpt-webui). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
ramon-victor	freegpt-webui	—	098db3dfeb41555c2ca9269df0f13e10ec1c35dc	—

Weaknesses

CWE-362

References (5)

Authoritative record: CVE-2026-85704 at cve.org

Vendors: ramon-victor

Weaknesses: CWE-362

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-85704 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.