CVE-2024-13059 Details
Description
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
A path traversal vulnerability has been identified in Mintplex Labs' Anything-LLM, in versions prior to 1.3.1. This issue arises from improper handling of non-ASCII filenames by the Multer library, allowing attackers with manager or admin roles to write files to arbitrary locations on the server. The vulnerability can be exploited by crafting a filename that includes '../' sequences, which Multer fails to sanitize. This arbitrary file write capability can lead to remote code execution, as overwritten files could be executed by the server.
Users are advised to update to version 1.3.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/mintplex-labs/anything-llm/commit/0b7bf68f2c02ca68075970fbf85d5a70ca5e94ca | [email protected] | Patch |
| https://huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-29 | Path Traversal: '\..\filename' | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mintplexlabs anythingllm | < 1.3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2025 | Initial Analysis | [email protected] |
| Feb 11, 2025 | CVE Modified | CISA-ADP |
| Feb 10, 2025 | New CVE Received | [email protected] |