CVE-2024-10361 in librechat
Summary
by MITRE • 03/20/2025
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/12/2025
The vulnerability identified as CVE-2024-10361 represents a critical arbitrary file deletion flaw in the danny-avila/librechat application version v0.7.5-rc2. This security weakness specifically targets the /api/files endpoint, which serves as a critical interface for file management operations within the application. The vulnerability stems from inadequate input validation mechanisms that fail to properly sanitize user-supplied data before processing file deletion requests. When malicious actors submit crafted file paths through this endpoint, the application processes these requests without sufficient validation, creating an opportunity for path traversal attacks that can extend beyond the intended file system boundaries.
The technical implementation of this vulnerability aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The flaw allows attackers to manipulate file paths by using sequences such as "../" or similar techniques to navigate outside the designated file storage directories. This weakness directly enables attackers to delete files that reside outside the intended application scope, potentially compromising system integrity and availability. The vulnerability's impact extends beyond simple file removal, as it can be exploited to delete critical system files, user data repositories, or application configuration resources that are essential for proper system operation.
From an operational perspective, this vulnerability presents a significant risk to system availability and data integrity within the librechat application environment. Attackers can leverage this flaw to systematically remove critical application components, user-generated content, or system files that maintain the application's functionality and security posture. The exploitation of this vulnerability can result in complete service disruption, data loss, and potential system compromise that may require extensive recovery operations. The impact is particularly severe because the vulnerability allows for arbitrary file deletion without proper authentication or authorization checks, making it accessible to both authenticated and unauthenticated attackers depending on the application's access controls.
The security implications of CVE-2024-10361 align with several ATT&CK framework techniques including T1059 for command and script interpreter execution and T1486 for data destruction. Organizations utilizing this version of librechat should immediately implement mitigation strategies including input validation controls, proper path sanitization, and strict access controls for file management endpoints. The recommended approach involves implementing whitelisting mechanisms for file operations, enforcing strict directory boundaries for file access, and implementing comprehensive logging of file operations to detect potential exploitation attempts. Additionally, organizations should consider implementing web application firewalls and security monitoring solutions that can detect and prevent path traversal attack patterns. The vulnerability demonstrates the critical importance of input validation and proper access control implementation in preventing privilege escalation and unauthorized file system modifications that can severely impact system availability and data integrity.