What’s Vulnerable › Vulnerabilities
CVE-2024-47170: Agnai File Disclosure Vulnerability: JSON via Path Traversal
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-26 · updated 2026-06-17
- Weakness: CWE-35
Description
Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only. Version 1.0.330 fixes this issue.
Affected products
- agnaistic agnai: before 1.0.330 — fixed in 1.0.330
How to fix
Upgrade to a fixed version: agnaistic agnai 1.0.330. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-47170 or the next vulnerability affects your stack