CVE-2026-34371: 
NixOS vulnerability analysis and mitigation

CVE-2026-34371 is an arbitrary file write vulnerability in LibreChat (a ChatGPT-clone platform) caused by unsanitized path traversal in execute_code artifact filenames. Prior to version 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox and writes it to the filesystem using fs.writeFileSync() without sanitization, allowing traversal sequences (e.g., ../../../../../app/client/dist/poc.txt) to escape the intended upload directory. The vulnerability affects all LibreChat versions before 0.8.4 using the default local file storage strategy, and was published on April 7, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable code path spans three files: api/server/controllers/tools.js (reads untrusted { id, name } from artifact metadata and passes name directly to processCodeOutput()), api/server/services/Files/Code/process.js (constructs fileName = ${file_id}__${name} without normalization), and api/server/services/Files/Local/crud.js (calls fs.writeFileSync(path.join(directoryPath, fileName), buffer) where path.join() honors traversal segments). Exploitation requires the attacker to be an authenticated user with execute_code privileges on a deployment configured with fileStrategy: local, and the ability to cause the code sandbox to emit an artifact with an attacker-controlled filename and content. Image artifacts are not affected because they use a server-generated filename, but all non-image artifacts and agent callback paths reusing processCodeOutput() are vulnerable (GitHub Advisory).

Successful exploitation grants any authenticated user with execute_code access an arbitrary file write primitive as the LibreChat server process user, allowing writes outside the per-user upload directory to any path writable by the server. Critical abuse scenarios include overwriting served frontend assets in client/dist to inject attacker-controlled HTML/JavaScript, enabling persistent same-origin XSS against all users of the instance, or overwriting application configuration and code files to achieve remote code execution. The scope is changed (S:C) because the impact extends beyond the vulnerable component to the broader server filesystem and served web content (GitHub Advisory).

A proof-of-concept (PoC) with step-by-step Node.js commands is publicly available in the GitHub Security Advisory, demonstrating both writing to /tmp and overwriting files in the served frontend build directory. No evidence of in-the-wild exploitation has been observed as of the time of publication. The EPSS score is approximately 0.037% (0.000370), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a LibreChat deployment (version < 0.8.4) configured with fileStrategy: local and execute_code enabled. Authenticate as any user with access to the code execution feature.
2. Craft malicious artifact name: Prepare a path traversal payload as the artifact filename, e.g., ../../../../../app/client/dist/malicious.js to target the served frontend directory, or ../../../../../tmp/lc-owned.txt for a simpler write target.
3. Trigger execute_code with attacker-controlled artifact metadata: Invoke processCodeOutput() with the crafted name field — either via the normal LibreChat UI by manipulating the code sandbox response, or directly via the API. The sandbox artifact metadata (file.name) is passed unsanitized into the file write path.
4. Achieve arbitrary file write: The server constructs fileName = ${file_id}__${name} and calls fs.writeFileSync(path.join(directoryPath, fileName), buffer). Because path.join() resolves traversal sequences, the file is written to the attacker-specified location outside the upload directory.
5. Verify and escalate: Confirm the write by fetching the file from the LibreChat origin (e.g., curl http://127.0.0.1:3080/poc.txt). If targeting client/dist, overwrite a served JS asset with a malicious payload to achieve persistent XSS or, depending on deployment, escalate to remote code execution by overwriting application files (GitHub Advisory).

• File System: Unexpected files appearing outside the per-user upload directory (e.g., in /tmp, /app/client/dist/, or other application paths); files with names matching the pattern <file_id>__<traversal_path> in upload directories; modified or newly created .html, .js, or .txt files in the frontend build directory (client/dist).
• Logs: LibreChat server logs showing processCodeOutput() calls with artifact name fields containing ../ sequences; Node.js file write operations to paths outside the expected uploads directory; HTTP requests to unexpected static file paths (e.g., /poc.txt) returning 200 OK.
• Network: Outbound connections from the LibreChat server process to unexpected hosts following a code execution event; HTTP GET requests from users to newly created or modified static assets in client/dist.
• Process: Unexpected child processes spawned by the LibreChat Node.js process after a code execution event, particularly shells or network utilities (GitHub Advisory).

Upgrade LibreChat to version 0.8.4 or later, which sanitizes artifact filenames using path.basename() before persistence and enforces that the resolved path stays within the intended storage directory. For deployments unable to upgrade immediately, restrict access to the execute_code functionality to trusted users only, or switch from the default local file storage strategy to a remote/cloud storage backend where path traversal has no local filesystem impact. The fix also adds regression tests covering traversal variants including ../ sequences, absolute paths, and mixed separator variants (GitHub Advisory).

The vulnerability was reported by security researcher LoGGGG2402 and disclosed via GitHub's coordinated security advisory process on April 7, 2026. Coverage appeared on several CVE aggregation and threat intelligence platforms shortly after disclosure, including VulDB, CVEFeed, and InfinitSec. No major vendor statements beyond the official advisory or notable social media discussion have been identified (GitHub Advisory).