What’s Vulnerable › Vulnerabilities
CVE-2024-7957: Arbitrary File Overwrite in danswer-ai/danswer
- Severity: critical (CVSS 9.1 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-29
Description
An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.
Affected products
- danswer-ai/danswer: through latest
References
Get alerted when CVE-2024-7957 or the next vulnerability affects your stack