CVE-2024-4851 is a high severity server-side request forgery in the stangirard/quivr application, version 0.0.204, scored 7.7. The crawl endpoint fetches whatever URL it is given. No fixed version is confirmed in the record, so check the project and limit outbound access.
What's affected
The record names one version: Quivr 0.0.204 (the stangirard/quivr repository). The vulnerable code is the crawl_endpoint function in backend/routes/crawl_routes.py, where the url parameter is passed on to an outbound HTTP request.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: network reachable, low complexity, a low privilege account, no user interaction, and a changed scope. Confidentiality impact is high, integrity and availability are none.
Fixed version: the record points only to a huntr bounty report and I could not retrieve it, so I cannot name a patched release. Check the project's releases and commit history before relying on any version number. The weakness is CWE-918, server-side request forgery.
How to check if you're exposed
If you run Quivr, confirm the version from your deployment. For a Docker based install, look at the image tag or the git commit you built from. For a source checkout:
git -C /path/to/quivr describe --tags --always
Then look at whether the crawl route is reachable from users or the internet. A deployment where only trusted operators can call the API has a smaller exposure than one open to any registered account, because the vector requires low privileges.
Also check what the Quivr host can reach on its internal network. That reach is what an SSRF flaw borrows.
What to do now
- Identify every Quivr deployment and its version.
- Check the upstream repository for a commit that validates or restricts the crawl
urland upgrade to a build that contains it. - Until then, block outbound traffic from the Quivr backend to internal address ranges and cloud metadata addresses at the network layer.
- Restrict who can call the crawl route, or disable it at the reverse proxy if you do not use website ingestion.
- Review backend logs for crawl requests aimed at internal hostnames.
Why it matters
Server-side request forgery turns an application into a proxy. The server sits inside your network, behind the firewall, so a request it makes can reach internal dashboards, admin interfaces and metadata services that the public cannot. The record says exactly this: attackers can interact with internal services reachable from the Quivr host.
Features that fetch user supplied URLs are common in AI and document tools, which import web pages to build a knowledge base. The usual defense is an allow list of schemes and hosts, plus a resolver that refuses private address ranges after DNS resolution.
This CVE is not marked as exploited in the wild in the record and is not in the CISA KEV catalog.
Quick check
Is a patched Quivr version confirmed?
Not from the record. The only reference is a bounty report. Check the project releases for a fix that validates the crawl URL.
Why does a low privilege account matter here?
The vector requires some authentication. Deployments that let anyone register are more exposed than ones limited to staff.
Sources
- huntr bounty report (listed in the record; page content could not be retrieved)
- NVD record for CVE-2024-4851
Last reviewed: 19 October 2026.
