CVE-2024-11170highCWE-29

CVE-2024-11170: falha de alta gravidade em danny-avila/librechat

Path Traversal in danny-avila/librechat

Publicada em

Seguir esta CVE+ Monitorar danny-avila/librechat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 1.8%
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
danny-avila · danny-avila/librechat
CVEs relacionadas — danny-avila/librechat

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10361HIGHArbitrary File Deletion via Path Traversal in danny-avila/librechatEPSS 1.0%CVE-2024-11172HIGHDenial of Service in danny-avila/librechatEPSS 0.9%CVE-2024-11169HIGHUnhandled Exception Leading to Server Crash in danny-avila/librechatEPSS 0.9%CVE-2024-11173MEDIUMUnhandled Exception in danny-avila/librechatEPSS 0.9%CVE-2024-11167CRITICALImproper Access Control in danny-avila/librechatEPSS 0.6%CVE-2024-11171HIGHImproper Input Validation in danny-avila/librechatEPSS 0.5%