| Component | AnythingLLM |
| Severity | high (CVSS 7.5) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published (NVD) | 2024-02-27 |
| Last modified | 2026-06-17 |
| Affected versions | anythingllm < 1.0.0 |
| Fixed in | 1.0.0 |
| Weakness | CWE-918 |
| CISA KEV | not listed |
NVD description
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced. There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.
What to do
- Upgrade AnythingLLM to
1.0.0or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2024-0759
- https://github.com/mintplex-labs/anything-llm/commit/0db6c3b2aa1787a7054ffdaba975474f122c20eb
- https://huntr.com/bounties/9a978edd-ac94-41fc-8e3e-c35441bdd12b
Other AnythingLLM CVEs
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and ea...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1....
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...