mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Mintplexlabs |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-16342 | mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 09 Jul 2025 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Mintplexlabs
Mintplexlabs anythingllm |
|
| CPEs | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Mintplexlabs
Mintplexlabs anythingllm |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T18:11:35.275Z
Reserved: 2024-01-15T00:30:28.942Z
Link: CVE-2024-0549
Vulnrichment
Updated: 2024-08-01T18:11:35.275Z
NVD
Status : Analyzed
Published: 2024-04-16T00:15:07.603
Modified: 2025-07-09T19:37:14.540
Link: CVE-2024-0549
Redhat
No data.
OpenCVE Enrichment
No data.