LibreChat, a ChatGPT clone developed by danny‑avila, allows an attacker to write arbitrary files through the execute_code sandbox. The vulnerability originates from the unsanitized artifact filename supplied by the sandbox when generating code artifacts. When a malicious filename includes directory traversal sequences, the server concatenates it to the local file path and writes the file using fs.writeFileSync. This flaw falls under CWE‑22 and grants an attacker the ability to create or overwrite files as the LibreChat server user, potentially compromising configuration or injecting malicious code.

Any deployment of LibreChat prior to version 0.8.4 that uses the default local file strategy is impacted. The vulnerability affects the product named LibreChat from the vendor danny‑avila. No additional product versions are specified beyond the 0.8.4 threshold.

The CVSS score of 6.3 indicates moderate severity, while an EPSS score below 1% suggests a low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, relying on the ability to trigger the execute_code feature – presumably by providing executable code that returns a crafted filename. Once triggered, the attacker can write any file within the server’s writable directories, which is a critical privilege escalation risk.