CVE-2024-47169

CVE-2024-47169 is a critical arbitrary file upload vulnerability affecting Agnai, an AI-agnostic multi-user roleplaying chat system, in versions prior to 1.0.330. This flaw allows authenticated attackers to upload malicious files, including JavaScript, to arbitrary server locations, potentially leading to remote code execution and full server compromise. The vulnerability has a high CVSS score of 8.8, indicating a severe risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, and community discussion is minimal, the potential for unauthorized access and data leakage is significant for publicly hosted installations not utilizing S3-compatible storage.