mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Mintplexlabs |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-31636 | mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 09 Jul 2025 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Mintplexlabs
Mintplexlabs anythingllm |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Mintplexlabs
Mintplexlabs anythingllm |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-09-06T17:55:53.545Z
Reserved: 2024-03-27T19:07:34.622Z
Link: CVE-2024-3028
Vulnrichment
Updated: 2024-08-01T19:32:42.699Z
NVD
Status : Analyzed
Published: 2024-04-16T00:15:11.667
Modified: 2025-07-09T19:34:59.663
Link: CVE-2024-3028
Redhat
No data.
OpenCVE Enrichment
No data.