CVE-2024-47171: falha de média gravidade em agnaistic agnai
Agnai vulnerable to Relative Path Traversal in Image Upload
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.5%
Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
agnaistic · agnaiCVEs relacionadas — agnaistic agnai
No mesmo produto, das mais perigosas para as menos.
CVE-2024-47169HIGHAgnai vulnerable to Remote Code Execution via JS Upload using Directory TraversalEPSS 0.8%CVE-2024-47170MEDIUMAgnai File Disclosure Vulnerability: JSON via Path TraversalEPSS 0.5%CVE-2026-108753CRITICALAgnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker ComposeEPSS 0.4%