Paper/Archive/CVE-2024-52787

CVE-2024-52787

librechat librechat — An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filenam…

EPSS 0.8%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 55.9.559 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

librechat0.0.6–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/vemonet/libre-chat/pull/9 refgithub.com/vemonet/libre-chat/issues/10 refgithub.com/vemonet/libre-chat/commit/dbb8e3400e5258112179783d74c9cc54310cb72b refgist.github.com/jxfzzzt/276a6e8cfbc54d2c2711bb51d8d3dff3