Description

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.

INFO

Published Date :

2024-04-16T00:00:14.132Z

Last Modified :

2024-08-01T18:11:35.275Z

Source :

@huntr_ai
AFFECTED PRODUCTS

The following products are affected by CVE-2024-0549 vulnerability.

Vendors Products
Mintplexlabs
  • Anythingllm
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-0549.

URL Resource
https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62 cve-icon cve-icon cve-icon
https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact