CVE-2024-47169highCWE-35CWE-434

CVE-2024-47169: high-severity vulnerability in agnaistic agnai

Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Published

Follow this CVE+ Monitor agnai+ Monitor agnai

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.8%
Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
agnaistic · agnai
Related CVEs — agnaistic agnai

In the same product, most dangerous first.

CVE-2024-47171MEDIUMAgnai vulnerable to Relative Path Traversal in Image UploadEPSS 0.5%CVE-2024-47170MEDIUMAgnai File Disclosure Vulnerability: JSON via Path TraversalEPSS 0.5%CVE-2026-108753CRITICALAgnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker ComposeEPSS 0.4%