AnythingLLMPublished 26 Feb 2024NVD status: Analyzed

CVE-2024-0440

AnythingLLM: Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.

ComponentAnythingLLM
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published (NVD)2024-02-26
Last modified2026-06-17
Affected versions
< 1.0.0
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.0.0
WeaknessCWE-918
CISA KEVnot listed

NVD description

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.

What to do

  • Upgrade AnythingLLM to 1.0.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources