Vulnerabilities

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint.

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory.

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings.

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2.

mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality.

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models".

A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service.

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection.

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library.

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode.