CVE-2024-52787

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/an/an/a
librechatlibrechat0.0.6

References

Timeline

Published
Nov 25, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-527888.0Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as CVE-2024-527898.0Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in CVE-2024-52793.5A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown fuCVE-2024-527917.5Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part oCVE-2024-527926.5LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affCVE-2024-527935.1The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing:CVE-2024-527946.1Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is CVE-2024-527965.3Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In vCVE-2024-527977.5Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's ElasCVE-2024-527987.7path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be CVE-2024-527998.2Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessivCVE-2024-52804.7The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as esca