Path traversal vulnerability in Mintplex Labs anything-llm file upload
A path traversal vulnerability (CVE-2024-13059) in Mintplex Labs' anything-llm allowed potential arbitrary file writes through file uploads. The issue was patched by normalizing file paths in the upload handlers.
What happened
CVE-2024-13059 identified a path traversal vulnerability in anything-llm's file upload functionality that could allow arbitrary file writes.
The vulnerability was addressed by normalizing file paths in the multer file upload storage configuration across four upload handlers: fileUploadStorage, fileAPIUploadStorage, assetUploadStorage, and pfpUploadStorage.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.