CVE-2024-6583: Path Traversal in stangirard/quivr

Published Mar 20, 2025

Updated

A path traversal vulnerability exists in the latest version of stangirard/quivr. This vulnerability allows an attacker to upload files to arbitrary paths in an S3 bucket by manipulating the file path in the upload request.

Affected Software

2 affected components

stangirard quivr

quivr quivr=0.0.254

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-6583?

CVE-2024-6583 is considered a high severity vulnerability due to its potential to allow arbitrary file uploads.

How do I fix CVE-2024-6583?

To fix CVE-2024-6583, update to the latest version of stangirard/quivr that addresses this path traversal vulnerability.

What are the consequences of exploiting CVE-2024-6583?

Exploiting CVE-2024-6583 can lead to unauthorized file uploads to arbitrary paths in S3 buckets, compromising data privacy and integrity.

Which software is affected by CVE-2024-6583?

CVE-2024-6583 affects the stangirard/quivr software, specifically the latest version.

Is CVE-2024-6583 related to AWS S3 services?

Yes, CVE-2024-6583 directly involves the manipulation of file paths for uploads to AWS S3 services through the vulnerable software.