CVE-2024-10361

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10361
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10361.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10361
Published
2025-03-20T10:15:16.507Z
Modified
2026-04-10T05:08:36.916248Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.

References

Affected packages

Git / github.com/danny-avila/librechat

Affected ranges

Type
GIT
Repo
https://github.com/danny-avila/librechat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
020995514e667ec0b7e550e34f6b61fda62c62e6
Fixed
0b744db1e2af31a531ffb761584d85540430639c
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.7.5-rc2"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.6
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.3
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.6.10
v0.6.5
v0.6.6
v0.6.9
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.3-rc
v0.7.3-rc2
v0.7.4
v0.7.4-rc1
v0.7.5-rc1
v0.7.5-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10361.json"