CVE-2026-34371

LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox when persisting code-generated artifacts. On deployments using the default local file strategy, a malicious artifact filename containing traversal sequences (for example, ../../../../../app/client/dist/poc.txt) is concatenated into the server-side destination path and written with fs.writeFileSync() without sanitization. This gives any user who can trigger execute_code an arbitrary file write primitive as the LibreChat server user. This vulnerability is fixed in 0.8.4.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-qrm5-r67f-6692	Exploit Vendor Advisory
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-qrm5-r67f-6692	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-07 22:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34371

Mitre link : CVE-2026-34371

CVE.ORG link : CVE-2026-34371

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-34371", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34371", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T16:10:31.032341Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": "< 0.8.4"}]}]}], "published": "2026-04-07T22:16:22.227", "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-qrm5-r67f-6692", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-qrm5-r67f-6692", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox when persisting code-generated artifacts. On deployments using the default local file strategy, a malicious artifact filename containing traversal sequences (for example, ../../../../../app/client/dist/poc.txt) is concatenated into the server-side destination path and written with fs.writeFileSync() without sanitization. This gives any user who can trigger execute_code an arbitrary file write primitive as the LibreChat server user. This vulnerability is fixed in 0.8.4."}, {"lang": "es", "value": "LibreChat es un clon de ChatGPT con caracter\u00edsticas adicionales. Antes de la versi\u00f3n 0.8.4, LibreChat conf\u00eda en el campo de nombre devuelto por el sandbox de execute_code al persistir artefactos generados por c\u00f3digo. En implementaciones que utilizan la estrategia predeterminada de archivo local, un nombre de archivo de artefacto malicioso que contiene secuencias de recorrido (por ejemplo, '.. / ../.. / ../../app/client/dist/poc.txt') se concatena en la ruta de destino del lado del servidor y se escribe con fs.writeFileSync() sin sanitizaci\u00f3n. Esto otorga a cualquier usuario que puede activar execute_code una primitiva de escritura de archivo arbitraria como el usuario del servidor de LibreChat. Esta vulnerabilidad se corrige en la versi\u00f3n 0.8.4."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63FE1740-F55B-4D56-92E5-407F97DA3475", "versionEndExcluding": "0.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}