CVE-2026-24478: falha de alta gravidade em Mintplex-Labs anything-llm
AnythingLLM vulnerable to Path Traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.9%
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker who can convince an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE) by overwriting configuration files or writing executable scripts. Version 1.10.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Mintplex-Labs · anything-llmCVEs relacionadas — Mintplex-Labs anything-llm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-24477HIGHAnythingLLM has key leak in `systemSettings.js`EPSS 2.1%CVE-2024-22422HIGHUnauthenticated Denial of Service (DOS) attack in AnythingLLMEPSS 1.0%CVE-2026-32626CRITICALAnythingLLM has a Streaming Phase XSS to RCE via LLM Response InjectionEPSS 0.8%CVE-2026-21484MEDIUMAnythingLLM Vulnerable to Username Enumeration w/ Password RecoveryEPSS 0.8%CVE-2026-32617HIGHAnythingLLM Permissable CORS policyEPSS 0.5%CVE-2026-32719MEDIUMAnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin ImportEPSS 0.5%