Vulnerability · Published Sep 26, 2024 · Assigned by GitHub_M

CVE-2024-47171Agnai vulnerable to Relative Path Traversal in Image Upload

Medium 4.3

In plain English

A medium-severity security flaw in agnai from agnaistic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	agnai	1.0.330	GHSA-g54f-66mw-hv66

Affected products (as reported)

Vendor	Product	Versions
agnaistic	agnai	< 1.0.330

Weakness: CWE-35 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66 x_refsource_CONFIRM
https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140: x_refsource_MISC
https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55 x_refsource_MISC