Critical severity9.1NVD Advisory· Published Mar 20, 2025· Updated Apr 15, 2026
CVE-2024-7957
CVE-2024-7957
Description
An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: latest
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.