quivr vulnerabilities and fixes

Recent CVEs affecting quivr, with upgrade or downgrade steps. 4 tracked.

quivr has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-03-20. Highest priority: CVE-2024-5885 (score 52/100).

• CVE-2024-6583 MEDIUM 4.3 DOWNGRADE A path traversal vulnerability exists in the latest version of stangirard/quivr
• CVE-2024-6229 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr
• CVE-2024-5885 HIGH 8.6 DOWNGRADE stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability
• CVE-2024-4851 HIGH 7.7 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204

FAQ

How do I fix quivr vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is quivr being exploited right now?

None of the tracked quivr CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which quivr CVE should I patch first?

CVE-2024-5885 currently ranks highest (52/100): stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability.

RSS feed for quivr · ← Back to latest CVEs