CVE-2024-10361

Katalog CVE

CVSS 9.1 · Critical EPSS 1,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada librechat. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c patch
• https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d exploit · advisory pihak ketiga