EUVD-2026-39462Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible endpoint requires only an authenticated session (PR:L); no confidentiality or availability impact, integrity impact limited to agent tool_resources writes.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1.
AnalysisAI
LibreChat's POST /api/files/images endpoint lacks the authorization check that was correctly applied to the POST /api/files route in a prior patch, allowing any authenticated user to upload files into arbitrary agents' tool_resources (including context and execute_code environments) without ownership or EDIT permission verification. All LibreChat deployments prior to 0.8.4-rc1 are affected across any multi-user configuration. No active exploitation has been confirmed (not in CISA KEV), but the bypass is trivially exercisable by any valid session holder who knows a target agent ID.
Technical ContextAI
LibreChat (cpe:2.3:a:danny-avila:librechat:*:*:*:*:*:*:*:*) is a self-hosted multi-provider AI chat interface that exposes REST API endpoints for file management. Agents within LibreChat support tool_resources such as 'context' (RAG-style file context injection) and 'execute_code' (sandboxed code execution environments). The application exposes two upload routes: POST /api/files and POST /api/files/images. A prior security patch added ownership/permission enforcement to the former but not the latter, creating an exploitable inconsistency. The root cause is CWE-862 (Missing Authorization) - a classic incomplete fix pattern where a security control is applied to one code path but not all equivalent paths serving the same sensitive operation.
RemediationAI
Upgrade to LibreChat 0.8.4-rc1 or later, which introduces the missing authorization check on the POST /api/files/images endpoint, bringing it to parity with the POST /api/files route. The vendor advisory is available at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5. If immediate upgrade is not feasible, operators can block or restrict access to the /api/files/images endpoint at the reverse proxy or API gateway layer, preventing unauthorized use of the vulnerable route; note this will disable image upload functionality for all users, including legitimate ones. Alternatively, restricting LibreChat access to a single trusted user or eliminating multi-user exposure reduces the attack surface, since exploitation requires one authenticated user targeting another user's agent.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of f
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /ap
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, lead
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), th
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this v
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltra
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today