Filtered by vendor Mintplexlabs
Subscribe
Total
73 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-0550 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 6.5 MEDIUM |
| A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack. | |||||
| CVE-2024-0549 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 8.1 HIGH |
| mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability. | |||||
| CVE-2024-0455 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 7.5 HIGH |
| The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL ``` http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance ``` which is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it. The user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper `iptable` or firewall rule is not configured for their setup. | |||||
| CVE-2024-0440 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 6.5 MEDIUM |
| Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files. | |||||
| CVE-2024-0439 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 8.8 HIGH |
| As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request While this is not a critical vulnerability, it does indeed need to be patched to enforce the expected permission level. | |||||
| CVE-2024-0436 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 5.9 MEDIUM |
| Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack given the linear nature of the `!==` used for comparison. The risk is minified by the additional overhead of the request, which varies in a non-constant nature making the attack less reliable to execute | |||||
| CVE-2024-0435 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 5.4 MEDIUM |
| User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS renders is only limited to the user who submits the XSS. Ultimately, this attack is limited to the user attacking themselves. There is no anonymous chat submission unless the user does not take the minimum steps required to protect their instance. | |||||
| CVE-2024-0404 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 9.1 CRITICAL |
| A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, thereby gaining administrative access. This issue arises due to the lack of property allowlisting and blocklisting, enabling the attacker to exploit the system and perform actions as an administrator. | |||||
| CVE-2023-5833 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 8.8 HIGH |
| Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. | |||||
| CVE-2023-5832 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 9.1 CRITICAL |
| Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. | |||||
| CVE-2023-4899 | 1 Mintplexlabs | 1 Anything-llm | 2026-06-17 | N/A | 8.8 HIGH |
| SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. | |||||
| CVE-2023-4898 | 1 Mintplexlabs | 1 Anything-llm | 2026-06-17 | N/A | 7.5 HIGH |
| Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. | |||||
| CVE-2023-4897 | 1 Mintplexlabs | 1 Anythingllm | 2026-06-17 | N/A | 9.8 CRITICAL |
| Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. | |||||