What’s Vulnerable › Vulnerabilities

CVE-2024-47171: Agnai vulnerable to Relative Path Traversal in Image Upload

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-26 · updated 2026-06-17
• Weakness: CWE-35

Description

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.

Affected products

• agnaistic agnai: before 1.0.330 — fixed in 1.0.330

How to fix

Upgrade to a fixed version: agnaistic agnai 1.0.330. Check the vendor advisory for mitigations.

References

• https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140:
• https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55
• https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66

Get alerted when CVE-2024-47171 or the next vulnerability affects your stack