CVE-2024-0549: mintplexlabs anythingllm

csirt@kutim:~/threat-intel/cve/CVE-2024-0549

CVSS 8.1 · High EPSS 0,82%

Kerentanan Relative Path Traversal pada mintplexlabs anythingllm. Skor CVSS 3.0 8.1 (High) menurut huntr.dev.

Deskripsi (NVD)

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.

Rincian

Terbit di NVD: 16 April 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.0: 8.1 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-23: Relative Path Traversal
EPSS (30 hari): 0,82% peluang dieksploitasi; lebih tinggi dari 56,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mintplexlabs	anythingllm	Semua versi sebelum 1.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62 patch
https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.