Danswer: Resource management error vulnerability

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. A resource management error vulnerability exists in Danswer version v0.3.94, which stems from the fact that uploading a file with malformed multi-part boundaries may...

Danswer: Cross-site Request Forgery Vulnerability

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. A cross-site request forgery vulnerability exists in Danswer v1.4.1. An attacker exploiting this vulnerability could perform unauthorized actions in the victim's...

Danswer Access Control Vulnerability

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An access control error vulnerability exists in Danswer version 0.4.1 that stems from the ability for a basic user to create credentials and link them to an existing...

Danswer Access Control Vulnerability

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An access control error vulnerability exists in Danswer version v0.3.94 that stems from the application not validating the file creator, which could allow an attacke...

Danswer security vulnerabilities

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. A security vulnerability exists in Danswer version v0.3.94, which stems from the back-end not validating the visibility status of a search page, which could allow an...

PT-2025-12197

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer versions prior to the fixed version Description An arbitrary file overwrite issue exists in the ZulipConnector, arising from the load credentials method. This method uses user-controlled input for realm name and zuliprc...

PT-2025-12189

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version v0.3.94 Description An improper access control issue exists, allowing the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive...

PT-2025-12193

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 1 Description A vulnerability allows an attacker to perform a Regular Expression Denial of Service ReDoS by manipulating regular expressions. This can significantly slow down the application's response time and...

PT-2025-12210

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description A Denial of Service DoS issue allows an attacker to cause the application to become inaccessible by uploading a file with a malformed multipart boundary. This is achieved by appending a large numbe...

PT-2025-12299

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.9.0 Description The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. This can be exploited by sending multiple requests to...

CVE-2024-7957: Path Traversal: '\..\filename'

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the loadcredentials method, where user-controlled input for realmname and zuliprccontent is used to construct file paths and write file content...

CVE-2024-7767: Missing Authorization

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...

PT-2025-12289

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description The issue allows an attacker to view any files due to a lack of verification of whether the attacker is the creator of the file. This can be exploited by directly calling the GET /api/chat/file/fil...

CVE-2025-0182: Allocation of Resources Without Limits or Throttling

A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending...

CVE-2024-9612: Insufficient Isolation of System-Dependent Functions

In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end doe...

CVE-2024-8065: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-8057: Missing Authentication for Critical Function

In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to...

CVE-2024-8028: Allocation of Resources Without Limits or Throttling

A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service DoS by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering th...

CVE-2024-7819: Origin Validation Error

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the...

CVE-2024-7779: Inefficient Regular Expression Complexity

A vulnerability in danswer-ai/danswer version 1 allows an attacker to perform a Regular Expression Denial of Service ReDoS by manipulating regular expressions. This can significantly slow down the application's response time and potentially render it completely unusable...