PT-2024-15649 · Mintplex · Anything-Llm

Published 2024-04-15 · Updated 2025-07-09 · CVE-2024-0549

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm (affected versions not specified)

Description The issue allows unauthorized attackers with a default role account to perform a relative path traversal attack, enabling them to delete files and folders within the filesystem. This includes critical database files such as anythingllm.db. The vulnerability is caused by insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-0549

Affected Products

Anything-Llm

References · 8

• 🔥 https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0549 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0549 · Vendor Advisory
• https://t.me/cvenotify/128272 · Telegram Post
• https://twitter.com/CVEnew/status/1780039219341332602 · Twitter Post
• https://t.me/cvenotify/76886 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780111779088978238 · Twitter Post