PT-2025-12038 · Librechat · Librechat

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10361

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions danny-avila/librechat version v0.7.5-rc2

Description An arbitrary file deletion issue exists, specifically within the "/api/files" endpoint, due to improper input validation. This allows path traversal techniques to delete arbitrary files on the server, including critical system files, user data, or application resources, thus impacting the integrity and availability of the system.

Recommendations For danny-avila/librechat version v0.7.5-rc2, consider disabling access to the "/api/files" endpoint until a patch is available to prevent exploitation. Additionally, restrict the ability to perform file deletion operations to minimize the risk of arbitrary file deletion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2024-10361

Affected Products

Librechat

References · 5

• 🔥 https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d · Exploit
• https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-10361 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10361 · Vendor Advisory
• https://twitter.com/CVEnew/status/1903036512100299003 · Twitter Post