CVE-2024-11170: LibreChat Path Traversal Vulnerability

CVE-2024-11170 Overview

CVE-2024-11170 is a path traversal vulnerability in danny-avila/librechat at commit 81f2936. The multer middleware fails to sanitize uploaded filenames, allowing authenticated attackers to write files outside the intended upload directory. Successful exploitation can lead to arbitrary file write and, under favorable conditions, remote code execution. The maintainers addressed the issue in version 0.7.6 by introducing a filename sanitization utility. The weakness is classified as [CWE-29: Path Traversal: \..\filename].

Critical Impact
Authenticated attackers can write arbitrary files to the LibreChat server filesystem, enabling potential remote code execution and full application compromise.

Affected Products

LibreChat versions prior to 0.7.6
LibreChat git commit 81f2936 (confirmed vulnerable)
Deployments using default multer disk storage configuration

Discovery Timeline

2025-03-20 - CVE-2024-11170 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11170

Vulnerability Analysis

LibreChat uses the multer Node.js middleware to handle multipart file uploads. In the vulnerable code path (api/server/routes/files/multer.js), the storage engine used the client-supplied filename without normalization. Attackers can inject traversal sequences such as ../ into the filename field of the multipart upload request.

Because the application concatenates the filename with a destination directory before calling fs.writeFile, traversal sequences escape the upload sandbox. This lets attackers place arbitrary content at attacker-controlled paths on the server, including locations loaded by Node.js at runtime.

The vulnerability requires low-privilege authentication and no user interaction. Writing to executable paths such as configuration files, cron directories, or Node module locations can escalate the primitive to remote code execution.

Root Cause

The root cause is missing input validation on the filename property returned by multer's diskStorage handler. The pre-patch implementation trusted the client-provided name and did not strip directory separators or .. sequences before persisting the file.

Attack Vector

An authenticated attacker submits a multipart/form-data upload request to a LibreChat file upload endpoint. The filename field of the payload contains a traversal string such as ../../../opt/librechat/config.js. The server writes the uploaded content to the traversed path, overwriting or creating files outside the intended upload directory.

javascript

// Patch: api/server/routes/files/multer.js
 const crypto = require('crypto');
 const multer = require('multer');
 const { fileConfig: defaultFileConfig, mergeFileConfig } = require('librechat-data-provider');
+const { sanitizeFilename } = require('~/server/utils/handleText');
 const { getCustomConfig } = require('~/server/services/Config');
 
 const storage = multer.diskStorage({

Source: GitHub Commit 629be5c

javascript

// Patch: api/server/utils/handleText.js
+const path = require('path');
+const crypto = require('crypto');
 const {
   Capabilities,
   EModelEndpoint,

Source: GitHub Commit 629be5c

The patch adds a sanitizeFilename utility built on the standard path module and integrates it into the multer disk storage configuration, ensuring traversal sequences are stripped before files are written.

Detection Methods for CVE-2024-11170

Indicators of Compromise

Files created outside the configured LibreChat uploads directory, particularly under application code paths or system directories
Multipart upload requests where the filename parameter contains ../, ..\, URL-encoded traversal sequences, or absolute paths
Unexpected modifications to LibreChat configuration files, Node modules, or startup scripts on the host
New or modified JavaScript files loaded by the LibreChat Node.js process outside deployment windows

Detection Strategies

Inspect HTTP access logs for POST requests to LibreChat file upload routes with suspicious filename values in the multipart body
Enable filesystem auditing on the LibreChat application directory to detect writes originating from the Node.js process outside the uploads path
Alert on process execution anomalies where the LibreChat process spawns unexpected child processes after upload activity

Monitoring Recommendations

Forward LibreChat application and web server logs to a central analytics platform and query for traversal patterns in upload payloads
Monitor integrity of the LibreChat installation directory using file integrity monitoring (FIM)
Track outbound network connections from the LibreChat host for signs of post-exploitation callbacks

How to Mitigate CVE-2024-11170

Immediate Actions Required

Upgrade LibreChat to version 0.7.6 or later, which includes the sanitizeFilename utility and the patched multer storage configuration
Audit the LibreChat uploads directory and application filesystem for files written outside expected locations since deployment
Rotate credentials, API keys, and session secrets that may have been exposed if arbitrary file write was achieved
Restrict authenticated access to trusted users until patching is complete

Patch Information

The fix is available in LibreChat 0.7.6 and is implemented in commit 629be5c. The patch adds a filename sanitization helper in api/server/utils/handleText.js and applies it inside the multer diskStorage configuration in api/server/routes/files/multer.js. Additional context is available in the Huntr Bounty Listing.

Workarounds

Run the LibreChat process as an unprivileged user with write access limited to the uploads directory only
Deploy LibreChat inside a container with a read-only root filesystem and a dedicated writable volume for uploads
Place a reverse proxy or web application firewall (WAF) rule in front of LibreChat that blocks multipart uploads containing .., /, or \ in the filename field
Disable file upload endpoints for user roles that do not require them

bash

# Example WAF-style rule expressed with nginx to block traversal in multipart filenames
location /api/files {
    if ($request_body ~* "filename=\"[^\"]*\.\.[^\"]*\"") {
        return 400;
    }
    proxy_pass http://librechat_upstream;
}