CVE-2024-3025

Katalog CVE

CVSS 9.9 · Critical EPSS 1,0%

Kerentanan Relative Path Traversal pada mintplexlabs anythingllm. Skor CVSS 3.0 9.9 (Critical) menurut huntr.dev.

Deskripsi (NVD)

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can lead to unauthorized reading or deletion of files by utilizing the `/api/system/upload-logo` and `/api/system/logo` endpoints. The issue stems from the lack of filtering or validation on the logo filename, allowing attackers to target sensitive files such as the application's database.

Rincian

Terbit di NVD

10 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

9.9 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce patch
• https://huntr.com/bounties/fb09a352-1016-4481-ae88-7460e2b6062b exploit · advisory pihak ketiga