PT-2025-12225 · Mintplex · Anything-Llm

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-8248

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.2.2

Description A vulnerability in the normalizePath function allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the normalizePath function to minimize the risk of exploitation.

Exploit

Fix

LPE

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-8248

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8248 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8248 · Vendor Advisory
• https://t.me/cvenotify/129033 · Telegram Post
• https://twitter.com/CVEnew/status/1902670972454670699 · Twitter Post