Path Traversal Vulnerability in Anything-LLM by Mintplex Labs

CVE-2024-8248

What is CVE-2024-8248?

A vulnerability exists within the normalizePath function of the Anything-LLM application, allowing attackers to exploit path traversal techniques. This flaw enables unauthorized access to the system's file storage, facilitating arbitrary file read and write operations. Consequently, this can lead to privilege escalation, where a user with manager privileges can elevate their status to administrative access. The vulnerability has been addressed and patched in version 1.2.2 of the product.

References