CVE-2024-8248CWE-29

Path Traversal in mintplex-labs/anything-llm

High · published March 20, 2025

CVSS v3.0
7.2
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00894 · 59.1th percentile
Weakness
CWE-29 · Path Traversal: '\..\filename'
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    Path Traversal in mintplex-labs/anything-llm
    cvelistv5