HighVulnerabilityLLM-specific
CVE-2025-69220: LibreChat improper access control on agent file context uploads
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-69220
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
LibreChat version 0.8.1-rc2 does not enforce proper access control on file uploads to an agent's file context and file search. An authenticated attacker who knows an agent ID can upload files that change that agent's behavior, even without permissions for it.
Mitigation
This issue is fixed in version 0.8.2-rc2.