AnythingLLMPublished 28 Feb 2024NVD status: Analyzed

CVE-2024-0550

AnythingLLM: A user who is privileged already manager or admin can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files.

ComponentAnythingLLM
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published (NVD)2024-02-28
Last modified2026-06-17
Affected versions
< 1.0.0
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.0.0
WeaknessCWE-23
CISA KEVnot listed

NVD description

A user who is privileged already manager or admin can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.

What to do

  • Upgrade AnythingLLM to 1.0.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources