CVE-2024-10361

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c	Patch
https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:0.7.5:rc2:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-10-15 13:15

NVD link : CVE-2024-10361

Mitre link : CVE-2024-10361

CVE.ORG link : CVE-2024-10361

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-10361", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:16.507", "references": [{"url": "https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system."}, {"lang": "es", "value": "Existe una vulnerabilidad de eliminaci\u00f3n arbitraria de archivos en la versi\u00f3n v0.7.5-rc2 de danny-avila/librechat, espec\u00edficamente en el endpoint /api/files. Esta vulnerabilidad se debe a una validaci\u00f3n de entrada incorrecta, lo que permite que t\u00e9cnicas de path traversal eliminen archivos arbitrarios en el servidor. Los atacantes pueden explotar esto para eludir los mecanismos de seguridad y eliminar archivos fuera del directorio previsto, incluyendo archivos cr\u00edticos del sistema, datos de usuario o recursos de la aplicaci\u00f3n. Esta vulnerabilidad afecta la integridad y la disponibilidad del sistema."}], "lastModified": "2025-10-15T13:15:35.453", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.7.5:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4C51559-DB5B-4B18-9F59-F290208874FD"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}