Vulnerabilities

TI-2024-09594 CVE-2024-10359 · GHSA-w4cv-4jm4-pg8h

Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat

MEDIUM 54

In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment.

CVSS 3.0MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00386 Published 2025-03-20 Fixed in 0.7.5 CWE-915

TI-2024-09598 CVE-2024-10363 · GHSA-mhmr-w8pp-75w5

Improper Access Control in danny-avila/LibreChat

MEDIUM 58

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability.

CVSS 3.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00361 Published 2025-03-20 Fixed in 0.7.5 CWE-862

TI-2024-09600 CVE-2024-10366 · GHSA-h5p2-273c-rxjp

IDOR in delete attachments in danny-avila/librechat

MEDIUM 62

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00374 Published 2025-03-20 Fixed in 0.7.5 CWE-639

TI-2024-09596 CVE-2024-10361 · GHSA-xcp6-jv5m-jwrm

Arbitrary File Deletion via Path Traversal in danny-avila/librechat

HIGH 72

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01013 Published 2025-03-20 Fixed in 0.7.5 CWE-22

Vulnerabilities

Filters

Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat

Improper Access Control in danny-avila/LibreChat

IDOR in delete attachments in danny-avila/librechat

Arbitrary File Deletion via Path Traversal in danny-avila/librechat