CVE-2024-47171: fallo de gravedad media en agnaistic agnai
Agnai vulnerable to Relative Path Traversal in Image Upload
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.5%
Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
agnaistic · agnaiCVEs relacionadas — agnaistic agnai
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-47169HIGHAgnai vulnerable to Remote Code Execution via JS Upload using Directory TraversalEPSS 0.8%CVE-2024-47170MEDIUMAgnai File Disclosure Vulnerability: JSON via Path TraversalEPSS 0.5%CVE-2026-108753CRITICALAgnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker ComposeEPSS 0.4%