CVE-2024-8248

Katalog CVE

CVSS 7.2 · High EPSS 0,89%

Kerentanan Path Traversal: '\..\filename' pada mintplexlabs anythingllm. Skor CVSS 3.0 7.2 (High) menurut huntr.dev.

Deskripsi (NVD)

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

7.2 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-29: Path Traversal: '\..\filename'

EPSS (30 hari)

0,89% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 patch
• https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e exploit · advisory pihak ketiga