Mintplex-Labs Anything-Llm vulnerabilities

CVE-2026-5627 [HIGH] CWE-29 CVE-2026-5627: A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils/agentFlows/index.js`. Specifically, the combination of `path.join` and `normalizePath` allows a

CVE-2024-0759 [HIGH] CWE-918 CVE-2024-0759: Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly gr Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be able to guess these internal IPs as `/*` ranging is not p

CVE-2024-3110 [HIGH] CWE-79 CVE-2024-3110: A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm applicati A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom ico

CVE-2024-3283 [HIGH] CWE-915 CVE-2024-3283: A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their priv A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endp

CVE-2024-3028 [HIGH] CWE-20 CVE-2024-3028: mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read an mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting th

CVE-2023-5832 [CRITICAL] CWE-20 CVE-2023-5832: Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.

CVE-2024-3029 [HIGH] CWE-20 CVE-2024-3029: In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malfor In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and

CVE-2024-0455 [HIGH] CWE-918 CVE-2024-0455: The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization l The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL ``` http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance ``` which is a special IP and URL that resolves only when the request comes from wit

CVE-2024-0795 [HIGH] CWE-284 CVE-2024-0795: If an attacked was given access to an instance with the admin or manager role there is no backend au If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance

CVE-2024-3101 [HIGH] CWE-20 CVE-2024-3101: In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escala In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multi_user_mode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This action permits the creation of a new admin user without requi

CVE-2024-4287 [HIGH] CWE-20 CVE-2024-4287: In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the worksp In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to `/api/workspace/:workspace-slug/update`, allowing it to be executed as part of a database query without restrictions. This flaw enables

CVE-2024-5211 [HIGH] CWE-29 CVE-2024-5211: A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normal A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversal attacks. This vulnerability enables the manager to read, delete, or overwrite the 'anythingllm.db' database file and other files stored in the 'storage' directory, such as internal communicatio

CVE-2024-8248 [HIGH] CWE-29 CVE-2024-8248: A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allo A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.

CVE-2024-3569 [HIGH] CWE-400 CVE-2024-3569: A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password. An attacker can exploit this vulnerability by making a request to the endpoint using the [validatedRequest] middleware with a specially crafted 'Authorization:' header. This vulnerability leads to

CVE-2023-4897 [CRITICAL] CWE-23 CVE-2023-4897: Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

CVE-2024-8249 [HIGH] CWE-248 CVE-2024-8249: mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) v mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoint, causing a server crash due to an uncaught exception. This issue is fixed in version 1.2.2.

CVE-2023-4898 [HIGH] CWE-305 CVE-2023-4898: Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0 Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

CVE-2024-7783 [HIGH] CWE-312 CVE-2024-7783: mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, spec mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, a

CVE-2024-0798 [MEDIUM] CWE-272 CVE-2024-0798: A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'defa A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restriction that prevents 'default' role users from deleting admin-uploaded documents, an attacker can exploit this vulnerability by sending a crafted DELETE request to the /api/sys

CVE-2024-5216 [HIGH] CWE-400 CVE-2024-5216: A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue arises from the application's failure to limit the size of usernames, enabling attackers to create users with excessively bulky texts in the username field. This exploit results in the user managem