CVE-2024-47169

Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

State: Published
Severity: 8.8 High
Published: Sep 26, 2024
Updated: Sep 26, 2024
Reserved: Sep 19, 2024

Description

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-35 Path Traversal: '.../...//'
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
agnaiagnaistic	< 1.0.330Affected

References

https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.