EUVD-2026-39464Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-exploitable by any authenticated user with no special conditions; impact is availability-only resource exhaustion with no confidentiality or integrity consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fileSize } to createMulterInstance() in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that was never updated with the same limits configuration. Combined with the application-level size check being disabled by default (the CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES env var is commented out in .env.example), an authenticated user can upload arbitrarily large files to exhaust server disk space and memory. This vulnerability is fixed in 0.8.4-rc1.
AnalysisAI
Unrestricted file upload to the POST /api/convos/import endpoint in LibreChat prior to 0.8.4-rc1 allows any authenticated user to exhaust server disk space and memory, causing a denial of service. The root cause is an incomplete remediation of CVE-2024-11171: while file size limits were added to the shared multer factory, the import endpoint's independent multer instance was never updated, and the application-level fallback guard (CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES) is commented out in .env.example by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity for any authenticated user makes this a meaningful operational risk for public-facing or open-registration deployments.
Technical ContextAI
LibreChat is a self-hosted, open-source AI chat interface (CPE: cpe:2.3:a:danny-avila:librechat) built on Node.js. It uses multer, a Node.js middleware for handling multipart/form-data, to process file uploads. The prior fix for CVE-2024-11171 (commit bb58a2d0) introduced file size limits via a createMulterInstance() factory, but the /api/convos/import route instantiates its own separate multer object outside this factory, inheriting no size constraints. A secondary application-level guard via the CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES environment variable exists in code but is commented out in the distributed .env.example, making it effectively disabled in default deployments. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling), a resource management weakness where a user-controlled input path consumes unbounded server-side resources due to missing enforcement.
RemediationAI
The primary fix is upgrading LibreChat to version 0.8.4-rc1 or later, which applies file size limits to the /api/convos/import multer instance, closing the patch gap from CVE-2024-11171. Before patching, administrators can enable the application-level guard by explicitly setting CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES to a reasonable byte value (e.g., 10485760 for 10 MB) in the environment configuration - note this variable is commented out in .env.example and will not take effect unless explicitly uncommented or added. As a network-layer alternative, configure a reverse proxy (nginx via client_max_body_size, Caddy via request_body max_size) in front of LibreChat to enforce upload size limits before requests reach the application; this adds defense in depth but does not fix the underlying code defect. Restricting access to the /api/convos/import endpoint to trusted user roles, if LibreChat's RBAC supports it, reduces exposure without disabling the feature. See https://github.com/danny-avila/LibreChat/security/advisories/GHSA-52f6-fqwv-jccf for the authoritative vendor advisory.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of f
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /ap
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, lead
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), th
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this v
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltra
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today