AVID-2026-R1606

Description

Arbitrary File Overwrite in danswer-ai/danswer (CVE-2024-7957)

Details

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.

Reason for inclusion in AVID: CVE-2024-7957 describes an arbitrary file overwrite vulnerability in the ZulipConnector of danswer-ai/danswer, caused by user-controlled inputs used to construct file paths and write contents. It is a security vulnerability with high impact (CVE CVSS 9.1, I/H, A/H) and affects a software component (danswer) that is used in AI systems/pipelines. This places it within the realm of AI-related software and within the scope of general-purpose AI system supply chains (dependencies, runtimes, model-serving components, etc.). The report provides sufficient evidence (CWE-29 path traversal, details of the vulnerable method, affected artifact, and CVSS data) to justify curation. Therefore, it should be kept as a GP AI supply chain vulnerability.

References

• NVD entry
• https://huntr.com/bounties/21e9b909-036c-4544-ad35-6a5117836275

Affected or Relevant Artifacts

• Developer: danswer-ai
• Deployer: danswer-ai
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2025-03-20
• Version: 0.3.3
• AVID Entry