Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10513Path Traversal in mintplex-labs/anything-llm

High 7.2

In plain English

A high-severity security flaw in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.0)7.2High

Exploit odds (30 days)0.9%top 40.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.

Affected products (as reported)

Vendor	Product	Versions
mintplex-labs	mintplex-labs/anything-llm	unspecified – before 1.2.2

Weakness: CWE-23 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References