Path Traversal Vulnerability in Mintplex-Labs Anything-LLM
A path traversal vulnerability (CVE-2024-8248) was discovered in Mintplex-Labs' Anything-LLM that could allow administrators to access files outside intended directories via the move-files function. The vulnerability was patched by adding path normalization controls.
What happened
A path traversal vulnerability (CVE-2024-8248) was identified in the move-files functionality of Anything-LLM, potentially allowing administrators to access files outside intended directories.
Governance controls
Mintplex-Labs patched the vulnerability by adding path normalization to the move-files endpoint in server/endpoints/api/document/index.js.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.