PT-2026-1932 · Librechat · Librechat

CVE-2025-69220 · Publicado 2026-01-07 · Atualizado 2026-01-07

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.2-rc2

Description LibreChat, a ChatGPT clone, does not properly control access when uploading files to an agent's file context or during file searches in version 0.8.1-rc2. An authenticated attacker who knows an agent ID can modify the behavior of agents by uploading files, even without proper permissions. The issue involves improper access control related to file uploads and searches within the agent's file context.

Recommendations Update to version 0.8.2-rc2 or later.

Exploit

Correção

Missing Authorization

Improper Access Control

Enumeração de Fraquezas

CWE-862

CWE-284

Identificadores relacionados

CVE-2025-69220

GHSA-XCMF-RPMH-HG59

Produtos afetados

Librechat

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69220.json · Exploit
• https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2 · Nota
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-xcmf-rpmh-hg59 · Aviso do Fabricante
• https://github.com/danny-avila/LibreChat/commit/4b9c6ab1cb9de626736de700c7981f38be08d237 · Correção
• https://osv.dev/vulnerability/CVE-2025-69220 · Aviso do Fabricante
• https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema.html · Nota
• https://cwe.mitre.org/data/definitions/284.html · Nota
• https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-69220 · Nota de Segurança
• https://owasp.org/Top10/A01_2021-Broken_Access_Control · Nota
• https://twitter.com/CVEnew/status/2009020519195267081 · Publicação no Twitter
• https://cwe.mitre.org/data/definitions/862.html · Nota