CVE-2024-11170: Path Traversal in danny-avila/librechat
Published Mar 20, 2025
·Updated
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.
Affected Software
2 affected components
danny-avila librechat<0.7.6
librechat librechat<0.7.6
Remediation
Event History
Mar 20, 2025
CVE Published
via MITRE·10:08 AM
Data Sourced
via MITRE·10:08 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-11170?
CVE-2024-11170 has a critical severity due to its potential for arbitrary file write and remote code execution.
2
How do I fix CVE-2024-11170?
To fix CVE-2024-11170, update librechat to version 0.7.6 or later.
3
What causes CVE-2024-11170?
CVE-2024-11170 is caused by improper sanitization of file paths in the multer middleware.
4
What software is affected by CVE-2024-11170?
CVE-2024-11170 affects all versions of librechat prior to version 0.7.6.
5
Can CVE-2024-11170 lead to remote code execution?
Yes, CVE-2024-11170 can potentially allow for remote code execution due to the path traversal vulnerability.