| Component | AnythingLLM |
| Severity | medium (CVSS 6.5) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published (NVD) | 2024-03-03 |
| Last modified | 2026-06-17 |
| Affected versions | anythingllm < 1.0.0 |
| Fixed in | 1.0.0 |
| Weakness | CWE-200 |
| CISA KEV | not listed |
NVD description
As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.
What to do
- Upgrade AnythingLLM to
1.0.0or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2024-0765
- https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2
- https://huntr.com/bounties/8978ab27-710c-44ce-bfd8-a2ea416dc786
Other AnythingLLM CVEs
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and ea...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1....
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...