Anything LLm Vulnerable to Relative Path Traversal Attack

CVE-2024-0549

What is CVE-2024-0549?

A relative path traversal vulnerability exists in Mintplex Labs' Anything LLM product, which may allow unauthorized users to execute file and folder deletion commands. This security weakness is rooted in inadequate input validation and normalization processes when handling deletions. Attackers with a default role account could exploit this flaw to gain unauthorized access to critical filesystem components, potentially deleting vital database files such as 'anythingllm.db'. The implications of such actions may lead to significant disruptions in data integrity and availability, necessitating immediate attention and remediation actions.

References