Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-108753 (GCVE-0-2026-108753)

Vulnerability from nvd – Published: 2026-10-11 12:19 – Updated: 2026-10-13 19:44

Title

Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

Summary

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 19:44 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7380 records in the last 180 days details

References

6 references

URL	Tags
https://hackmd.io/@haind/agnai-selfhost-compose-h…	third-party-advisory
https://github.com/agnaistic/agnai/blob/6c3de258c…	technical-description
https://github.com/agnaistic/agnai/blob/6c3de258c…	technical-description
https://github.com/agnaistic/agnai/blob/6c3de258c…	technical-description
https://github.com/agnaistic/agnai	product
https://www.vulncheck.com/advisories/agnaistic-ag…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
agnaistic	agnai	Affected: 0 , ≤ 1.0.555 (semver) cpe:2.3:a:agnai:agnai::::::::

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108753",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:44:26.724370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:44:48.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secret"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/agnai",
          "product": "agnai",
          "repo": "https://github.com/agnaistic/agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "lessThanOrEqual": "1.0.555",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:agnai:agnai:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.555",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:52.688Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secret"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/self-host.docker-compose.yml#L18-L26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/README.md#L75-L82"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/srv/api/auth.ts#L11-L14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/agnaistic/agnai"
        },
        {
          "name": "VulnCheck Advisory: Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/agnaistic-agnai-through-1.0.555-hard-coded-credentials-in-self-host-docker-compose"
        }
      ],
      "title": "Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108753",
    "datePublished": "2026-10-11T12:19:52.688Z",
    "dateReserved": "2026-10-11T01:54:17.948Z",
    "dateUpdated": "2026-10-13T19:44:48.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47171 (GCVE-0-2024-47171)

Vulnerability from nvd – Published: 2024-09-26 17:21 – Updated: 2024-09-26 17:53

Title

Agnai vulnerable to Relative Path Traversal in Image Upload

Summary

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 17:50 UTC

CWE

CWE-35 - Path Traversal: '.../...//'

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/agnaistic/agnai/security/advis…	x_refsource_CONFIRM
https://github.com/agnaistic/agnai/blob/75abbd5b0…	x_refsource_MISC
https://github.com/agnaistic/agnai/blob/75abbd5b0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
agnaistic	agnai	Affected: < 1.0.330

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T17:50:57.850067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T17:53:23.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.330"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T17:21:52.646Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66"
        },
        {
          "name": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140:",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140:"
        },
        {
          "name": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55"
        }
      ],
      "source": {
        "advisory": "GHSA-g54f-66mw-hv66",
        "discovery": "UNKNOWN"
      },
      "title": "Agnai vulnerable to Relative Path Traversal in Image Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47171",
    "datePublished": "2024-09-26T17:21:52.646Z",
    "dateReserved": "2024-09-19T22:32:11.961Z",
    "dateUpdated": "2024-09-26T17:53:23.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47170 (GCVE-0-2024-47170)

Vulnerability from nvd – Published: 2024-09-26 17:16 – Updated: 2025-03-12 21:16

Title

Agnai File Disclosure Vulnerability: JSON via Path Traversal

Summary

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only. Version 1.0.330 fixes this issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-10 17:06 UTC

CWE

CWE-35 - Path Traversal: '.../...//'

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/agnaistic/agnai/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
agnaistic	agnai	Affected: < 1.0.330

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47170",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-10T17:06:45.896136Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-12T21:16:50.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.330"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only. Version 1.0.330 fixes this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T17:16:21.950Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h"
        }
      ],
      "source": {
        "advisory": "GHSA-h355-hm5h-cm8h",
        "discovery": "UNKNOWN"
      },
      "title": "Agnai File Disclosure Vulnerability: JSON via Path Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47170",
    "datePublished": "2024-09-26T17:16:21.950Z",
    "dateReserved": "2024-09-19T22:32:11.961Z",
    "dateUpdated": "2025-03-12T21:16:50.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47169 (GCVE-0-2024-47169)

Vulnerability from nvd – Published: 2024-09-26 17:11 – Updated: 2024-09-26 18:23

Title

Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Summary

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 17:33 UTC

CWE

CWE-35 - Path Traversal: '.../...//'
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/agnaistic/agnai/security/advis…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
agnaistic	agnai	Affected: < 1.0.330
agnai	agnai	Affected: 0 , < 1.0.330 (custom) cpe:2.3:a:agnai:agnai::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:agnai:agnai:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "agnai",
            "vendor": "agnai",
            "versions": [
              {
                "lessThan": "1.0.330",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47169",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T17:33:28.285073Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T18:23:22.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.330"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T17:11:42.815Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83"
        }
      ],
      "source": {
        "advisory": "GHSA-mpch-89gm-hm83",
        "discovery": "UNKNOWN"
      },
      "title": "Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47169",
    "datePublished": "2024-09-26T17:11:42.815Z",
    "dateReserved": "2024-09-19T22:32:11.960Z",
    "dateUpdated": "2024-09-26T18:23:22.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-108753 (GCVE-0-2026-108753)

Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-13 19:44

Title

Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

Summary

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 19:44 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7380 records in the last 180 days details

References

6 references

URL	Tags
https://hackmd.io/@haind/agnai-selfhost-compose-h…	third-party-advisory
https://github.com/agnaistic/agnai/blob/6c3de258c…	technical-description
https://github.com/agnaistic/agnai/blob/6c3de258c…	technical-description
https://github.com/agnaistic/agnai/blob/6c3de258c…	technical-description
https://github.com/agnaistic/agnai	product
https://www.vulncheck.com/advisories/agnaistic-ag…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
agnaistic	agnai	Affected: 0 , ≤ 1.0.555 (semver) cpe:2.3:a:agnai:agnai::::::::

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108753",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:44:26.724370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:44:48.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secret"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/agnai",
          "product": "agnai",
          "repo": "https://github.com/agnaistic/agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "lessThanOrEqual": "1.0.555",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:agnai:agnai:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.555",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:52.688Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/agnai-selfhost-compose-hardcoded-admin-jwt-secret"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/self-host.docker-compose.yml#L18-L26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/README.md#L75-L82"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/srv/api/auth.ts#L11-L14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/agnaistic/agnai"
        },
        {
          "name": "VulnCheck Advisory: Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/agnaistic-agnai-through-1.0.555-hard-coded-credentials-in-self-host-docker-compose"
        }
      ],
      "title": "Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108753",
    "datePublished": "2026-10-11T12:19:52.688Z",
    "dateReserved": "2026-10-11T01:54:17.948Z",
    "dateUpdated": "2026-10-13T19:44:48.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47171 (GCVE-0-2024-47171)

Vulnerability from cvelistv5 – Published: 2024-09-26 17:21 – Updated: 2024-09-26 17:53

Title

Agnai vulnerable to Relative Path Traversal in Image Upload

Summary

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 17:50 UTC

CWE

CWE-35 - Path Traversal: '.../...//'

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/agnaistic/agnai/security/advis…	x_refsource_CONFIRM
https://github.com/agnaistic/agnai/blob/75abbd5b0…	x_refsource_MISC
https://github.com/agnaistic/agnai/blob/75abbd5b0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
agnaistic	agnai	Affected: < 1.0.330

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T17:50:57.850067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T17:53:23.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.330"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T17:21:52.646Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66"
        },
        {
          "name": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140:",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140:"
        },
        {
          "name": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55"
        }
      ],
      "source": {
        "advisory": "GHSA-g54f-66mw-hv66",
        "discovery": "UNKNOWN"
      },
      "title": "Agnai vulnerable to Relative Path Traversal in Image Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47171",
    "datePublished": "2024-09-26T17:21:52.646Z",
    "dateReserved": "2024-09-19T22:32:11.961Z",
    "dateUpdated": "2024-09-26T17:53:23.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47170 (GCVE-0-2024-47170)

Vulnerability from cvelistv5 – Published: 2024-09-26 17:16 – Updated: 2025-03-12 21:16

Title

Agnai File Disclosure Vulnerability: JSON via Path Traversal

Summary

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only. Version 1.0.330 fixes this issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-10 17:06 UTC

CWE

CWE-35 - Path Traversal: '.../...//'

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/agnaistic/agnai/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
agnaistic	agnai	Affected: < 1.0.330

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47170",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-10T17:06:45.896136Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-12T21:16:50.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.330"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only. Version 1.0.330 fixes this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T17:16:21.950Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h"
        }
      ],
      "source": {
        "advisory": "GHSA-h355-hm5h-cm8h",
        "discovery": "UNKNOWN"
      },
      "title": "Agnai File Disclosure Vulnerability: JSON via Path Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47170",
    "datePublished": "2024-09-26T17:16:21.950Z",
    "dateReserved": "2024-09-19T22:32:11.961Z",
    "dateUpdated": "2025-03-12T21:16:50.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47169 (GCVE-0-2024-47169)

Vulnerability from cvelistv5 – Published: 2024-09-26 17:11 – Updated: 2024-09-26 18:23

Title

Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Summary

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-26 17:33 UTC

CWE

CWE-35 - Path Traversal: '.../...//'
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/agnaistic/agnai/security/advis…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
agnaistic	agnai	Affected: < 1.0.330
agnai	agnai	Affected: 0 , < 1.0.330 (custom) cpe:2.3:a:agnai:agnai::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:agnai:agnai:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "agnai",
            "vendor": "agnai",
            "versions": [
              {
                "lessThan": "1.0.330",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47169",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T17:33:28.285073Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T18:23:22.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "agnai",
          "vendor": "agnaistic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.330"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T17:11:42.815Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83"
        }
      ],
      "source": {
        "advisory": "GHSA-mpch-89gm-hm83",
        "discovery": "UNKNOWN"
      },
      "title": "Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47169",
    "datePublished": "2024-09-26T17:11:42.815Z",
    "dateReserved": "2024-09-19T22:32:11.960Z",
    "dateUpdated": "2024-09-26T18:23:22.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities by agnaistic

CVE-2026-108753 (GCVE-0-2026-108753)

CVE-2024-47171 (GCVE-0-2024-47171)

CVE-2024-47170 (GCVE-0-2024-47170)

CVE-2024-47169 (GCVE-0-2024-47169)

CVE-2026-108753 (GCVE-0-2026-108753)

CVE-2024-47171 (GCVE-0-2024-47171)

CVE-2024-47170 (GCVE-0-2024-47170)

CVE-2024-47169 (GCVE-0-2024-47169)