CVE-2024-47171mediumCWE-35

CVE-2024-47171: medium-severity vulnerability in agnaistic agnai

Agnai vulnerable to Relative Path Traversal in Image Upload

Published

Follow this CVE+ Monitor agnai+ Monitor agnai

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.5%
Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
agnaistic · agnai
Related CVEs — agnaistic agnai

In the same product, most dangerous first.

CVE-2024-47169HIGHAgnai vulnerable to Remote Code Execution via JS Upload using Directory TraversalEPSS 0.8%CVE-2024-47170MEDIUMAgnai File Disclosure Vulnerability: JSON via Path TraversalEPSS 0.5%CVE-2026-108753CRITICALAgnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker ComposeEPSS 0.4%