Path Traversal Vulnerability in mintplex-labs anything-llm

CVE-2024-3025

What is CVE-2024-3025?

The Anything-LLM product developed by Mintplex Labs is susceptible to path traversal attacks due to the inadequate validation of user input in the logo filename feature. Malicious actors can exploit this flaw by crafting specific logo filenames that reference files outside the designated directory, impacting the security and integrity of the application. This vulnerability is particularly concerning as it allows for unauthorized reading and potential deletion of sensitive files, including database files, via the vulnerable API endpoints (/api/system/upload-logo and /api/system/logo). Such issues highlight the importance of stringent input validation and proper file access controls to safeguard against data breaches.

References