Relative Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability.

N/A

相对路径遍历

AnythingLLM 路径遍历漏洞

AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM 存在路径遍历漏洞，该漏洞源于处理文件和文件夹删除请求时输入验证和规范化不足，允许具有默认角色帐户的未经授权的攻击者删除文件系统中的文件和文件夹，包括关键数据库文件，例如：anythingllm.db。

N/A

N/A