CVE-2024-11170CWE-29

Path Traversal in danny-avila/librechat

High · published March 20, 2025

CVSS v3.0
8.8
EPSS
2%
Percentile
78.5
In the wild
Unconfirmed
What it is

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01814 · 78.5th percentile
Weakness
CWE-29 · Path Traversal: '\..\filename'
Published
2025-03-20T10:08Z
EPSS history
Timeline
  • 20 MAR 10:08Z
    Path Traversal in danny-avila/librechat
    cvelistv5