PT-2024-35440 · Librechat · Librechat

Jxfzzzt · Published 2024-11-25 · Updated 2024-11-27 · CVE-2024-52787

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions libre-chat version 0.0.6

Description The issue allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file, specifically in the upload documents method.

Recommendations For libre-chat version 0.0.6, consider restricting the use of the upload documents method until a patch is available to prevent path traversal attacks. Avoid using crafted filenames in uploaded files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-52787

GHSA-3864-RP2M-2QFJ

Affected Products

Librechat

References · 9

• https://osv.dev/vulnerability/CVE-2024-52787 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52787 · Security Note
• https://osv.dev/vulnerability/GHSA-3864-rp2m-2qfj · Vendor Advisory
• https://github.com/vemonet/libre-chat/issues/10 · Note
• https://github.com/vemonet/libre-chat/commit/dbb8e3400e5258112179783d74c9cc54310cb72b · Note
• https://github.com/vemonet/libre-chat/pull/9 · Note
• https://github.com/vemonet/libre-chat · Note
• https://gist.github.com/jxfzzzt/276a6e8cfbc54d2c2711bb51d8d3dff3 · Note
• https://twitter.com/CVEnew/status/1861112390458491104 · Twitter Post