THREATIST.IORead the docs No mintplex-labs vulnerabilities are listed in CISA KEV.
67 records in Anythingllm · all components
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes.
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint.
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables.
mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality.
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints.
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator.
A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm.
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting.
mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality.
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings.
A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption.
A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0.
As a manager, you should not be able to modify a series of settings.
In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint.
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models".
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal.
mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database fil…
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library.