AnythingLLMPublished 20 Mar 2025NVD status: Analyzed

CVE-2024-8248

AnythingLLM: A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory.

ComponentAnythingLLM
Severityhigh (CVSS 7.2)
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published (NVD)2025-03-20
Last modified2026-06-17
Affected versions
< 1.2.2
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.2.2
WeaknessCWE-29
CISA KEVnot listed

NVD description

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.

What to do

  • Upgrade AnythingLLM to 1.2.2 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources