Path Traversal in Mintplex-Labs Mintplex-Labs/anything-Llm
CVE-2024-13059
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
EPSS: 0.213 (97.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mintplex-labs Mintplex-labs/anything-llm — versions unspecified
- Mintplexlabs Anythingllm
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Third Party Advisory)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2024-13059?
- CVE-2024-13059 is a high-severity vulnerability in Mintplex-Labs Mintplex-Labs/anything-Llm, classified under CWE-29. CVSS score: 7.2/10. Published 2025-02-10.
- How severe is CVE-2024-13059?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2024-13059 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.