CVE-2024-13059— Path Traversal in mintplex-labs/anything-llm
Quick assessment
Affected
mintplex-labs mintplex-labs/anything-llm
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 1.3.1之前版本存在安全漏洞，该漏洞源于multer库对非ASCII文件名的路径遍历处理不当，可能导致任意文件写入。
Possible ATT&CK Techniques 2 AI
T1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol T1565.002 · Transmitted Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-13059
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in mintplex-labs/anything-llm
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
路径遍历：’..filename’
Source: CVE Program / CVE List V5
Vulnerability Title
anything-llm 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 1.3.1之前版本存在安全漏洞，该漏洞源于multer库对非ASCII文件名的路径遍历处理不当，可能导致任意文件写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified ~ 1.3.1 | - |
|
II. Public POCs for CVE-2024-13059
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-13059
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-13059 (1)
Vendor Advisories for CVE-2024-13059 (1)
IV. Related Vulnerabilities
Same product: mintplex-labs/anything-llm
-
CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-lab -
CVE-2024-8248
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything- -
CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm
Same vendor: mintplex-labs
-
CVE-2026-88055
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Co -
CVE-2026-72917
AnythingLLM: Password recovery accepts one recovery code twi -
CVE-2026-55611
AnythingLLM: embed-parsed-file cleanup deletes any parsed fi -
CVE-2026-48789
AnythingLLM: Windows path containment bypass in document fol -
CVE-2026-47713
AnythingLLM: Legacy mobile device tokens bypass multi-user w
V. Comments for CVE-2024-13059
No comments yet