Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: mintplex-labs/anything-llm 1.0.0 Clear all filters
TI-2024-00703 CVE-2024-0763 · GHSA-g46h-v66c-w8j9

Improper validation of document removal parameter

Priority HIGH 68

Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00901 Published 2024-02-27 Fixed in 1.0.0 CWE-22
TI-2024-00509 CVE-2024-0551 · GHSA-9gp8-9ccv-5c8h

Download and export of file via default user role

Priority MEDIUM 64

Enable exports of the database and associated exported information of the system via the default user role.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00562 Published 2024-02-27 Fixed in 1.0.0 CWE-284
TI-2024-00699 CVE-2024-0759 · GHSA-cw8v-p9jq-r69x

Collection of internally resolving IPs

Priority LOW 37

Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0092 Published 2024-02-27 Fixed in 1.0.0 CWE-918