Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8248Path Traversal in mintplex-labs/anything-llm
High 7.2
In plain English
A high-severity security flaw in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)0.9%top 40.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified – before 1.2.2 |
Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H