Vulnerability · Published Feb 10, 2025 · Assigned by @huntr_ai

CVE-2024-13059Path Traversal in mintplex-labs/anything-llm

High 7.2

In plain English

A high-severity security flaw in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 24.3% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.0)7.2High

Exploit odds (30 days)24.3%top 2.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.

Affected products (as reported)

Vendor	Product	Versions
mintplex-labs	mintplex-labs/anything-llm	unspecified – before 1.3.1

Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References