A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4 | Patch |
| https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Librechat
Librechat librechat |
|
| CPE | cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:* | |
| References | () https://github.com/danny-avila/librechat/commit/629be5c0ca2b332178524b4e3f6fac715aea8cc4 - Patch | |
| References | () https://huntr.com/bounties/b64156c2-5380-4d4d-af30-b2938dcdd46e - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 16:45
NVD link : CVE-2024-11170
Mitre link : CVE-2024-11170
JSON object : View
Products Affected
librechat
- librechat
CWE
CWE-29
Path Traversal: '\..\filename'