CVE-2024-10361: Arbitrary File Deletion via Path Traversal in danny-avila/librechat
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10361?
CVE-2024-10361 has been rated as a high severity vulnerability due to its potential for unauthorized file deletion on the server.
How do I fix CVE-2024-10361?
To fix CVE-2024-10361, validate all input for the /api/files endpoint to prevent path traversal attacks.
What kind of attacks does CVE-2024-10361 allow?
CVE-2024-10361 allows attackers to exploit path traversal techniques to delete arbitrary files on the server.
Which version of LibreChat is affected by CVE-2024-10361?
CVE-2024-10361 affects LibreChat version v0.7.5-rc2.
What should I do if I am using an affected version mentioned in CVE-2024-10361?
If you are using an affected version of LibreChat, you should update to the latest patched version to mitigate the vulnerability.