CVE-2024-8248— Path Traversal in mintplex-labs/anything-llm
Quick assessment
Affected
mintplex-labs mintplex-labs/anything-llm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 296f041版本存在安全漏洞，该漏洞源于normalizePath函数存在路径遍历，可能导致任意文件读写和权限提升。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-8248
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in mintplex-labs/anything-llm
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
路径遍历：’..filename’
Source: CVE Program / CVE List V5
Vulnerability Title
anything-llm 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 296f041版本存在安全漏洞，该漏洞源于normalizePath函数存在路径遍历，可能导致任意文件读写和权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified ~ 1.2.2 | - |
|
II. Public POCs for CVE-2024-8248
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-8248
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-8248 (1)
Vendor Advisories for CVE-2024-8248 (1)
Same Patch Batch · mintplex-labs · 2025-03-20 · 9 CVEs total
| CVE-2024-6842 | Exposure of Sensitive Information in mintplex-labs/anything-llm | |
| CVE-2024-13060 | Improper Authorization in mintplex-labs/anything-llm | |
| CVE-2024-7771 | Denial of Service in mintplex-labs/anything-llm | |
| CVE-2024-8196 | Missing Authentication for Critical Function in mintplex-labs/anything-llm | |
| CVE-2024-8251 | Prisma Injection in mintplex-labs/anything-llm | |
| CVE-2024-8249 | Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm | |
| CVE-2024-10109 | Incorrect Authorization in mintplex-labs/anything-llm | |
| CVE-2024-10513 | Path Traversal in mintplex-labs/anything-llm |
IV. Related Vulnerabilities
Same product: mintplex-labs/anything-llm
-
CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-lab -
CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything- -
CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-8249
Unauthenticated Denial of Service (DoS) in mintplex-labs/any
Same vendor: mintplex-labs
-
CVE-2026-88055
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Co -
CVE-2026-72917
AnythingLLM: Password recovery accepts one recovery code twi -
CVE-2026-55611
AnythingLLM: embed-parsed-file cleanup deletes any parsed fi -
CVE-2026-48789
AnythingLLM: Windows path containment bypass in document fol -
CVE-2026-47713
AnythingLLM: Legacy mobile device tokens bypass multi-user w
V. Comments for CVE-2024-8248
No comments yet