CVE-2025-69220High· 7.1▾ TwilightLibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.
librechat = 0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-69221Medium· 4.3LibreChat is a ChatGPT clone with additional features
CVE-2025-7106Medium· 5.3danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks
CVE-2025-69222Critical· 9.1LibreChat is a ChatGPT clone with additional features
CVE-2025-7104High· 7.5A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions
CVE-2025-8848Medium· 5.4A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header
CVE-2025-8849High· 7.5LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint