Path Traversal in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.

N/A

路径遍历：’..filename’

anything-llm 安全漏洞

anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 1.3.1之前版本存在安全漏洞，该漏洞源于multer库对非ASCII文件名的路径遍历处理不当，可能导致任意文件写入。

N/A

N/A