Path Traversal in Mintplex-Labs Mintplex-Labs/anything-Llm
CVE-2024-13059
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.213 (97.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.213 · newest: 0.213 · change: 0.000
Affected products
- Mintplex-Labs Mintplex-Labs/anything-Llm — versions unspecified
- Mintplexlabs Anythingllm
Weakness classification (CWE)
Public proof-of-concept exploits
References
- huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1 (Exploit, Third Party Advisory)
- github.com/mintplex-labs/anything-llm/commit/0b7bf68f2c02ca68075970fbf85d5a70ca… (Patch)
Frequently asked questions
- What is CVE-2024-13059?
- CVE-2024-13059 is a high-severity vulnerability in Mintplex-Labs Mintplex-Labs/anything-Llm, classified under CWE-29. CVSS score: 7.2/10. Published 2025-02-10.
- How severe is CVE-2024-13059?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2024-13059 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.