What is CVE-2024-11170?

CVE-2024-11170 is a high-severity vulnerability in Danny-Avila Danny-Avila/librechat, classified under CWE-29. CVSS score: 8.8/10. Published 2025-03-20.

How severe is CVE-2024-11170?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Danny-Avila Danny-Avila/librechat

CVE-2024-11170

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.

EPSS: 0.017 (74.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Danny-avila Danny-avila/librechat — versions unspecified
Librechat

Weakness classification (CWE)

CWE-29

References

security@huntr.dev (Exploit, Third Party Advisory)
security@huntr.dev (Patch)

Frequently asked questions

What is CVE-2024-11170?: CVE-2024-11170 is a high-severity vulnerability in Danny-Avila Danny-Avila/librechat, classified under CWE-29. CVSS score: 8.8/10. Published 2025-03-20.
How severe is CVE-2024-11170?: High severity. CVSS v3 base score is 8.8 out of 10.