CVE-2024-10513

Katalog CVE

CVSS 7.2 · High EPSS 0,89%

Kerentanan Relative Path Traversal pada mintplexlabs anythingllm. Skor CVSS 3.0 7.2 (High) menurut huntr.dev.

Deskripsi (NVD)

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

7.2 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,89% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 patch
• https://huntr.com/bounties/ad11cecf-161a-4fb1-986f-6f88272cbb9e exploit · advisory pihak ketiga