CVE-2024-7957

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the loadcredentials method, where user-controlled input for realmname and zuliprccontent is used to construct file paths and write file content...

CVE-2024-8065

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-7767 Improper Access Control in danswer-ai/danswer

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...

CVE-2024-7957

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the loadcredentials method, where user-controlled input for realmname and zuliprccontent is used to construct file paths and write file content...

CVE-2024-7957

The CVE-2024-7957 entry describes an arbitrary file overwrite vulnerability in the ZulipConnector of danswer-ai/danswer. The root cause is in load_credentials where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write contents, enabling overwriting or...

CVE-2025-0182 Denial of Service in danswer-ai/danswer

A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending...

CVE-2024-8028

A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service DoS by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering th...

CVE-2024-8028 Denial of Service in danswer-ai/danswer

A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service DoS by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering th...

CVE-2024-7779

A vulnerability in danswer-ai/danswer version 1 allows an attacker to perform a Regular Expression Denial of Service ReDoS by manipulating regular expressions. This can significantly slow down the application's response time and potentially render it completely unusable...

PT-2025-12193

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 1 Description A vulnerability allows an attacker to perform a Regular Expression Denial of Service ReDoS by manipulating regular expressions. This can significantly slow down the application's response time and...

PT-2025-12197

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer versions prior to the fixed version Description An arbitrary file overwrite issue exists in the ZulipConnector, arising from the load credentials method. This method uses user-controlled input for realm name and zuliprc...

PT-2025-12288

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description The issue allows attackers to bypass the visibility restriction set by administrators for the search page. When the search page is set to be invisible, regular users cannot view it or access its...

PT-2025-12289

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description The issue allows an attacker to view any files due to a lack of verification of whether the attacker is the creator of the file. This can be exploited by directly calling the GET /api/chat/file/fil...

PT-2025-12299

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.9.0 Description The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. This can be exploited by sending multiple requests to...