Input Validation Flaw in LibreChat Allows Large File Uploads
CVE-2026-54024

6.5MEDIUM

Key Information:

Vendor

Danny-avila

Status
Librechat
Vendor
CVE Published:
25 June 2026

What is CVE-2026-54024?

A vulnerability in LibreChat allows authenticated users to upload excessively large files due to an oversight in input validation. The POST /api/convos/import endpoint uses a multer instance that lacks the file size limits applied in other endpoints. Without appropriate safeguards, this vulnerability can lead to server resource exhaustion, impacting overall application performance. It is essential for users of LibreChat to upgrade to version 0.8.4-rc1 or later to mitigate this risk.

Affected Version(s)

LibreChat < 0.8.4-rc1

References

https://github.com/danny-avila/LibreChat/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.