PT-2024-35440 · Librechat · Librechat

Jxfzzzt · CVE-2024-52787 · Published 2024-11-25 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions libre-chat version 0.0.6

Description The issue allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file, specifically in the upload documents method.

Recommendations For libre-chat version 0.0.6, consider restricting the use of the upload documents method until a patch is available to prevent path traversal attacks. Avoid using crafted filenames in uploaded files to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-52787

GHSA-3864-RP2M-2QFJ

PYSEC-2026-1537

Affected Products

Librechat

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52787.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-1537 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3864-rp2m-2qfj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52787 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52787 · Vendor Advisory
• https://github.com/vemonet/libre-chat/commit/dbb8e3400e5258112179783d74c9cc54310cb72b · Note
• https://github.com/vemonet/libre-chat/issues/10 · Note
• https://github.com/vemonet/libre-chat · Note
• https://github.com/vemonet/libre-chat/pull/9 · Note
• https://pypi.org/project/libre-chat · Note
• https://gist.github.com/jxfzzzt/276a6e8cfbc54d2c2711bb51d8d3dff3 · Note
• https://twitter.com/CVEnew/status/1861112390458491104 · Twitter Post
• https://github.com/advisories/GHSA-3864-rp2m-2qfj · Note