{"id":"CVE-2024-52787","aliases":["EUVD-2024-3339","GHSA-3864-rp2m-2qfj","PYSEC-2026-1537"],"status":"published","title":"libre-chat Path Traversal vulnerability","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0078,"percentile":0.56356,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2024-11-25T00:00:00Z","modified":"2026-10-28T02:30:24Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"libre-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"libre-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.6"}]}],"versions":["0.0.4","0.0.6"]},{"source":"osv","ecosystem":"PyPI","package":"libre-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.6"}]}],"versions":["0.0.4","0.0.6"]}],"products":[{"vendor":"librechat","product":"librechat"}],"references":[{"url":"https://github.com/vemonet/libre-chat/pull/9","tags":["fix","web"]},{"url":"https://github.com/vemonet/libre-chat/issues/10","tags":["report","web"]},{"url":"https://github.com/vemonet/libre-chat/commit/dbb8e3400e5258112179783d74c9cc54310cb72b","tags":["fix","web"]},{"url":"https://gist.github.com/jxfzzzt/276a6e8cfbc54d2c2711bb51d8d3dff3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52787","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3864-rp2m-2qfj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52787.json","tags":["advisory"]},{"url":"https://github.com/vemonet/libre-chat","tags":["package"]},{"url":"https://pypi.org/project/libre-chat","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-52787","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2024-11-25T00:00:00Z","modified":"2024-11-27T16:35:53.218Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-3339","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2024-11-25T00:00:00Z","modified":"2024-11-27T16:35:53Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T00:04:45.657538Z"}],"ghsa":[{"id":"GHSA-3864-rp2m-2qfj","title":"libre-chat Path Traversal vulnerability","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2024-11-25T18:33:26Z","modified":"2024-11-27T19:32:39Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2024-52787","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2024-11-25T18:15:13.597Z","modified":"2026-06-17T08:07:37.733Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"CVE-2024-52787","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2024-11-25T00:00:00Z","modified":"2026-10-28T02:30:24.386314201Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-3864-rp2m-2qfj","title":"libre-chat Path Traversal vulnerability","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2024-11-25T18:33:26Z","modified":"2026-07-07T17:56:58.984998532Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"PYSEC-2026-1537","title":"libre-chat Path Traversal vulnerability","description":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","status":"published","published":"2026-07-07T14:34:45.726582Z","modified":"2026-07-07T17:46:51.28309826Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}