AnythingLLMPublished 27 Feb 2024NVD status: Modified

CVE-2024-0763

AnythingLLM: Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal.

ComponentAnythingLLM
Severityhigh (CVSS 8.1)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Published (NVD)2024-02-27
Last modified2026-06-17
Affected versions
< 1.0.0
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.0.0
WeaknessCWE-22
CISA KEVnot listed

NVD description

Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.

What to do

  • Upgrade AnythingLLM to 1.0.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources