CVE-2024-10513

Severity CVSS v4.0:

Pending analysis

Type:

CWE-23 Relative Path Traversal

Publication date:

20/03/2025

Last modified:

14/07/2025

Description

A path traversal vulnerability exists in the &#39;document uploads manager&#39; feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the &#39;manager&#39; role to access and manipulate the &#39;anythingllm.db&#39; database file. By exploiting the vulnerable endpoint &#39;/api/document/move-files&#39;, an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.

Impact

Vector 3.x

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 7.20 HIGH
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High