CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Path Traversal in mintplex-labs/anything-llm
A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.
Reserved 2024-10-29 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-23 Relative Path Traversal
huntr.com/bounties/ad11cecf-161a-4fb1-986f-6f88272cbb9e
github.com/...ommit/47a5c7126c20e2277ee56e2c7ee11990886a40a7
Support options
