MediumVulnerability
CVE-2026-54024: LibreChat conversation import endpoint accepts unbounded file uploads
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54024
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
LibreChat versions prior to 0.8.4-rc1 contain a flaw in the POST /api/convos/import endpoint, which uses a separate multer instance that never received the fileSize limit added to createMulterInstance() by the CVE-2024-11171 fix (commit bb58a2d0). The application-level size check is also disabled by default, since CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES is commented out in .env.example. An authenticated user can therefore upload arbitrarily large files, exhausting server disk space and memory.
Mitigation
Fixed in 0.8.4-rc1.
Related items
- MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
- HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
- HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database
- HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
- MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database