CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat

High 8.1 Published 20 Mar 2025 Updated 15 Oct 2025

Attackers can delete arbitrary files on the server via path traversal in the file API, compromising system integrity and availability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-10361?

CVE-2024-10361 is a high-severity path traversal vulnerability in Librechat Librechat, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.

Weakness: CWE-22

Which versions are affected by CVE-2024-10361?

It affects 1 product.

Products include Librechat Librechat.

How do I fix CVE-2024-10361?

No fix has been published for CVE-2024-10361 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-10361 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10361 exists.

All Librechat Librechat vulnerabilities

Sources

Also known as GHSA-xcp6-jv5m-jwrm.