CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

CVE-2024-11170

CVE-2024-11170 affects danny-avila/librechat (git 81f2936). The root cause is improper sanitization of file paths by the multer middleware, enabling path traversal that can cause arbitrary file write and potentially remote code execution. A fix exists in version 0.7.6. Public PoC details are prov...

CVE-2024-11170 Path Traversal in danny-avila/librechat

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

CVE-2024-11170

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

CVE-2024-11170 Path Traversal in danny-avila/librechat

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

CVE-2024-11170 Path Traversal in danny-avila/librechat

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone. A denial-of-service vulnerability exists in LibreChat that stems from certain API endpoints not handling incorrectly formatted input when received, which can be exploited by an attacker to cause the server to crash...

LibreChat 访问控制错误漏洞

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from an Improper Access Control vulnerability that can be exploited by an attacker to corrupt application logic and permissions and allow unauthorized operations...

PT-2025-12101

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6 Description The issue is caused by improper sanitization of file paths by the multer middleware, leading to path traversal. This can result in arbitrary file write and potentially remote code...

PT-2025-12038

Name of the Vulnerable Software and Affected Versions danny-avila/librechat version v0.7.5-rc2 Description An arbitrary file deletion issue exists, specifically within the "/api/files" endpoint, due to improper input validation. This allows path traversal techniques to delete arbitrary files on t...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone. An arbitrary file deletion vulnerability exists in LibreChat, which stems from improper /api/files endpoint input validation, and can be exploited by an attacker to cause arbitrary file deletion...

PT-2025-12099 · Librechat · Librechat

Name of the Vulnerable Software and Affected Versions: danny-avila/librechat versions prior to 0.7.6 Description: The issue is related to improper access control, allowing authenticated users to delete other users' prompts. This occurs because the endpoint does not verify whether the provided...

LibreChat 访问控制错误漏洞

LibreChat is an enhanced ChatGPT clone. An Access Control Error vulnerability exists in versions of LibreChat prior to 0.7.6, which stems from the groupid parameter not verifying that the prompt ID provided belongs to the current user, and can be exploited by an attacker to cause the deletion of...

LibreChat 资源管理错误漏洞

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from a denial of service vulnerability that can be exploited by an attacker to cause a server crash...

PT-2025-12100

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6 Description The issue is caused by an unhandled exception in the fs module when handling file uploads. This can be triggered by an unauthenticated user sending a specially crafted request, leading ...

CVE-2024-11173: Uncaught Exception

An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to...

CVE-2024-11172: Uncaught Exception

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware checkBan is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This...

CVE-2024-11170: Path Traversal: '\..\filename'

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. A security vulnerability exists in LibreChat version v0.7.5-rc2, which stems from a preset creation feature that allows a user to manipulate the user ID field, potentially causing presets to appear in other user interfaces...

LibreChat 输入验证错误漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. An input validation error vulnerability exists in LibreChat version 0c2a583, which stems from improper input validation and could lead to a server crash...