Executive brief
LibreChat, an open-source AI chat interface, contains a vulnerability that allows users to write files to unauthorized locations on the server. By manipulating the names of files generated during code execution tasks, an attacker can bypass security boundaries to overwrite system files or inject malicious web content. This could lead to a complete compromise of the application's frontend or persistent attacks against other users.
Technical details
A path traversal vulnerability exists in LibreChat's handling of code-generated artifacts when using the default local file storage strategy. The application trusts the 'name' field returned by the 'execute_code' sandbox without sanitization, passing it to 'fs.writeFileSync()' via 'path.join()'. An authenticated attacker can provide a filename containing traversal sequences (e.g., '../../') to write arbitrary content to any path writable by the LibreChat server process. This can be used to overwrite frontend assets in 'client/dist' to achieve persistent XSS or write to other sensitive directories. The issue is fixed in version 0.8.4 by properly sanitizing artifact filenames.
Affected products
- danny-avila LibreChat < 0.8.4
Timeline
- 2026-03-13: other: Vulnerability confirmed via PoC testing
- 2026-04-07: disclosed: Security advisory published by vendor
- 2026-04-07: patched: Fixed in version 0.8.4