Path Traversal Vulnerability in LibreChat by Danny Avila

CVE-2024-11170

What is CVE-2024-11170?

A path traversal vulnerability has been identified in LibreChat, a project by Danny Avila. This issue arises due to inappropriate sanitization of file paths handled by the multer middleware. Attackers can exploit this flaw to manipulate file paths, allowing for arbitrary file writes on the server. This can ultimately lead to potential remote code execution, posing significant security risks. The vulnerability has been addressed in version 0.7.6.

References