CVE-2025-69220

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-69220
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69220.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-69220
Aliases
  • GHSA-xcmf-rpmh-hg59
Related
Published
2026-01-07T20:49:00.454Z
Modified
2026-02-05T21:43:47.624357Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L CVSS Calculator
Summary
LibreChat has Insufficient Access Control for Agent Files
Details

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69220.json"
}
References

Affected packages

Git / github.com/danny-avila/librechat

Affected ranges

Type
GIT
Repo
https://github.com/danny-avila/librechat
Events
Introduced
f0f81945fb80e821f839d8fb29ccae0aaa471511
Fixed
24e8a258cd8fa1ff42c02cf15408079f1dbe07b0

Affected versions

chart-1.*
chart-1.9.3
chart-1.9.4
v0.*
v0.8.1
v0.8.1-rc2
v0.8.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69220.json"