What is the CVSS score of CVE-2026-34371?

CVE-2026-34371 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34371?

Yes, a patch is available for CVE-2026-34371. Update the affected software to the latest version immediately.

Librechat CVE-2026-34371

EUVD-2026-19946 MEDIUM

Path Traversal (CWE-22)

2026-04-07 GitHub_M

Path Traversal Librechat

6.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.8.4

EUVD ID Assigned

Apr 07, 2026 - 21:31 euvd

EUVD-2026-19946

Analysis Generated

Apr 07, 2026 - 21:31 vuln.today

CVE Published

Apr 07, 2026 - 21:08 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox when persisting code-generated artifacts. On deployments using the default local file strategy, a malicious artifact filename containing traversal sequences (for example, ../../../../../app/client/dist/poc.txt) is concatenated into the server-side destination path and written with fs.writeFileSync() without sanitization. This gives any user who can trigger execute_code an arbitrary file write primitive as the LibreChat server user. This vulnerability is fixed in 0.8.4.

AnalysisAI

Arbitrary file write in LibreChat prior to 0.8.4 allows authenticated users to overwrite arbitrary server files via path traversal in code artifact filenames. The vulnerability affects LibreChat deployments using the default local file storage strategy, where the execute_code sandbox returns a user-controllable filename that is concatenated directly into the file write path without sanitization. An authenticated attacker can craft malicious artifact names containing traversal sequences (e.g., ../../../../../app/client/dist/poc.txt) to write files outside the intended directory, potentially compromising application integrity or enabling remote code execution through client-side file injection.

Technical ContextAI

LibreChat's execute_code sandbox feature allows users to generate code artifacts stored via a pluggable file strategy system. The vulnerability stems from improper trust of the name field returned by the sandbox process. When using the default local file strategy (fs.writeFileSync), the application concatenates user-influenced filenames directly into the destination path without Path.normalize() or similar canonicalization, failing to filter directory traversal sequences. This is a classic Path Traversal (CWE-22) vulnerability where relative path components (../) are not stripped before filesystem operations. The affected code path is triggered whenever execute_code produces an artifact with a malicious filename, and any authenticated LibreChat user who can invoke code execution features is a potential attacker.

RemediationAI

The primary remediation is to upgrade LibreChat to version 0.8.4 or later, which includes the path traversal fix. For users unable to immediately upgrade, consider disabling the execute_code feature if not essential to operations, or implementing filesystem permissions restrictions to limit the damage from potential file writes (e.g., restricting server process permissions to specific directories). Additionally, audit recent LibreChat logs for any suspicious artifact filenames containing ../ sequences to detect potential exploitation attempts. The fix is available in the official GitHub repository at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-qrm5-r67f-6692, which documents the security advisory and patched release.