CVE-2024-3028— Improper Input Validation in mintplex-labs/anything-llm
Quick assessment
Affected
mintplex-labs mintplex-labs/anything-llm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM 存在输入验证错误漏洞，该漏洞源于未对用户提供的输入进行适当的清理，允许攻击者读取和删除服务器上的任意文件。
Possible ATT&CK Techniques 3 AI
T1070 · Indicator Removal T1083 · File and Directory Discovery T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-3028
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Input Validation in mintplex-labs/anything-llm
Source: CVE Program / CVE List V5
Vulnerability Description
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
AnythingLLM 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AnythingLLM是符合业务要求的文档聊天机器人。 AnythingLLM 存在输入验证错误漏洞，该漏洞源于未对用户提供的输入进行适当的清理，允许攻击者读取和删除服务器上的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified ~ 1.0.0 | - |
|
II. Public POCs for CVE-2024-3028
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-3028
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-3028 (1)
Vendor Advisories for CVE-2024-3028 (1)
Same Patch Batch · mintplex-labs · 2024-04-16 · 4 CVEs total
| CVE-2024-0404 | Mass Assignment Vulnerability in mintplex-labs/anything-llm | |
| CVE-2024-0549 | Relative Path Traversal in mintplex-labs/anything-llm | |
| CVE-2024-3029 | Improper Input Validation in mintplex-labs/anything-llm |
IV. Related Vulnerabilities
Same product: mintplex-labs/anything-llm
-
CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-lab -
CVE-2024-8248
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything- -
CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm
Same vendor: mintplex-labs
-
CVE-2026-88055
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Co -
CVE-2026-72917
AnythingLLM: Password recovery accepts one recovery code twi -
CVE-2026-55611
AnythingLLM: embed-parsed-file cleanup deletes any parsed fi -
CVE-2026-48789
AnythingLLM: Windows path containment bypass in document fol -
CVE-2026-47713
AnythingLLM: Legacy mobile device tokens bypass multi-user w
V. Comments for CVE-2024-3028
No comments yet