A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 | Patch |
| https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mintplexlabs anythingllm
Mintplexlabs |
|
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e - Exploit, Third Party Advisory | |
| References | () https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 - Patch |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:16
NVD link : CVE-2024-8248
Mitre link : CVE-2024-8248
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
CWE-29
Path Traversal: '\..\filename'