mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62 | Patch |
| https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62 | Patch |
| https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 | Exploit Third Party Advisory |
| https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 | Exploit Third Party Advisory |
Configurations
History
09 Jul 2025, 19:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
| First Time |
Mintplexlabs anythingllm
Mintplexlabs |
|
| References | () https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 - Exploit, Third Party Advisory | |
| References | () https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62 - Patch | |
| CWE |
16 Apr 2024, 13:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-16 00:15
Updated : 2025-07-09 19:37
NVD link : CVE-2024-0549
Mitre link : CVE-2024-0549
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
No CWE.