CVE-2024-0549
mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.
- Affected products
- Anything-Llm
- Mintplexlabs Anythingllm
- < 1.0.0
- CVSS 3.0
- 8.1 HIGH
- EPSS
- 0.8% (54th percentile)
- Weakness
- CWE-23
- NVD status
- Analyzed
- Published
- 2024-04-16
CVE-2024-0549 at NVD
No indexed exploits for CVE-2024-0549 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-0549 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.