CVE-2024-13059: high-severity vulnerability in mintplex-labs/anything-llm
Path Traversal in mintplex-labs/anything-llm
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
26Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 24%
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
mintplex-labs · mintplex-labs/anything-llmRelated CVEs — mintplex-labs/anything-llm
In the same product, most dangerous first.
CVE-2024-6842HIGHExposure of Sensitive Information in mintplex-labs/anything-llmEPSS 36.3%CVE-2024-5211CRITICALPath Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3025CRITICALPath Traversal in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3104CRITICALRemote Code Execution in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-3283HIGHPrivilege Escalation via Mass Assignment in mintplex-labs/anything-llmEPSS 0.9%