Path Traversal Vulnerability in Mintplex Labs' Document Uploads Manager

CVE-2024-10513

What is CVE-2024-10513?

A path traversal vulnerability has been identified in the document uploads manager feature of Mintplex Labs' Anything LLM. This security flaw allows users assigned the 'manager' role to exploit an insecure endpoint to access sensitive database files. By leveraging the '/api/document/move-files' endpoint, an attacker can manipulate the 'anythingllm.db' database file, transferring it to a publicly accessible location. This not only risks unauthorized access to sensitive information but also allows the attacker to delete the original file, potentially leading to significant data loss and integrity issues.

References