CVE-2024-50344: Mkucej I-Librarian-Free

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.

Affected products

• Mkucej I-Librarian-Free: before 5.11.2 (fixed in 5.11.2)

Published 2024-10-30. Last modified 2026-06-17.