CVE-2024-53617

Deeper analysis

LibrePhotos versions prior to commit 32237 contain a cross-site scripting vulnerability (CWE-79) combined with an insecure direct object reference (CWE-639) in the file-upload component. The flaw permits an authenticated high-privileged user to store an HTML file that is later rendered in the browser context of other users, including administrators.

An attacker who already possesses high privileges can leverage the IDOR condition to upload a malicious HTML payload on behalf of an administrator account. When the file is subsequently viewed, the embedded script executes with the victim’s session privileges, enabling the attacker to hijack any user account reachable through the application.

The issue is addressed by commit 32237ddc0b6293a69b983a07b5ad462fcdd6c929 and the associated pull request 1476, which restrict file-upload handling and prevent unauthorized object references. Public references also include a proof-of-concept repository demonstrating the attack chain.

The EPSS score remains flat at 0.0529 with no material increase after disclosure, indicating limited observed exploitation interest to date.