PT-2025-12101 · Danny Avila · Librechat

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-11170

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6

Description The issue is caused by improper sanitization of file paths by the multer middleware, leading to path traversal. This can result in arbitrary file write and potentially remote code execution.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 to resolve the issue. As a temporary workaround, consider restricting access to the multer middleware to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-11170

Affected Products

Librechat

References · 5

• 🔥 https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e · Exploit
• https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-11170 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11170 · Vendor Advisory
• https://twitter.com/CVEnew/status/1903336830973689891 · Twitter Post