Mintplexlabs Anythingllm
67 CVEs affecting Mintplexlabs Anythingllm. Latest disclosed: 2026-05-28. Critical: 8, High: 35.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3025 | Critical | 9.9 | 2024-04-10 | mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. At… |
CVE-2024-3104 | Critical | 9.8 | 2024-06-06 | A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulner… |
CVE-2023-4897 | Critical | 9.8 | 2023-09-11 | Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2026-32626 | Critical | 9.6 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM… |
CVE-2024-3033 | Critical | 9.4 | 2024-06-06 | An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. Th… |
CVE-2024-3279 | Critical | 9.1 | 2024-08-12 | An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allo… |
CVE-2024-0404 | Critical | 9.1 | 2024-04-16 | A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high… |
CVE-2023-5832 | Critical | 9.1 | 2023-10-30 | Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. |
CVE-2026-32628 | High | 8.8 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL inject… |
CVE-2024-3150 | High | 8.8 | 2024-06-06 | In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges… |
CVE-2024-3149 | High | 8.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manag… |
CVE-2024-3152 | High | 8.8 | 2024-06-06 | mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulne… |
CVE-2024-0439 | High | 8.8 | 2024-02-26 | As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would no… |
CVE-2023-5833 | High | 8.8 | 2023-10-30 | Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. |
CVE-2024-3110 | High | 8.7 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest befor… |
CVE-2024-10109 | High | 8.3 | 2025-03-20 | A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/syste… |
CVE-2024-0549 | High | 8.1 | 2024-04-16 | mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and f… |
CVE-2024-0763 | High | 8.1 | 2024-02-27 | Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need acces… |
CVE-2024-3029 | High | 8.0 | 2024-04-16 | In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoin… |
CVE-2026-48116 | High | 7.5 | 2026-05-28 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-sea… |