CVE-2024-7957

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.

• CWE-29

• https://huntr.com/bounties/21e9b909-036c-4544-ad35-6a5117836275

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7950The WP Job Portal – A Complete Recruitment System for Compan…9.8
• CVE-2024-7952A data exposure vulnerability exists in the affected product…8.7
• CVE-2024-7953A vulnerability exists in the affected products that allows …8.7
• CVE-2024-7954The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.…9.8
• CVE-2024-7955The Starbox WordPress plugin before 3.5.2 does not sanitise…4.8
• CVE-2024-7956A vulnerability exists in the affected products that allows …7.6
• CVE-2024-7958Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-7959Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-7960The Rockwell Automation affected product contains a vulnerab…9.1
• CVE-2024-7961A path traversal vulnerability exists in the Rockwell Automa…9.8
• CVE-2024-7962An arbitrary file read vulnerability exists in gaizhenbiao/c…7.5
• CVE-2024-7963The CMSMasters Content Composer plugin for WordPress is vuln…6.4