High severity · published Mar 20, 2025
CVE-2024-8248
Path Traversal in mintplex-labs/anything-llm
7.2
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
mintplex-labs/anything-llm · mintplex-labs
before 1.2.2 · source: vendor
AN
Anythingllm · Mintplexlabs
before 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8248
Patch
https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7
Exploit
https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e
More from mintplex-labs/anything-llm
9.9
CVE-2024-3025
Path Traversal in mintplex-labs/anything-llm
9.8
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-labs/anything-llm
9.8
CVE-2024-3104
Remote Code Execution in mintplex-labs/anything-llm
9.8
CVE-2023-4897
Relative Path Traversal in mintplex-labs/anything-llm
9.6
CVE-2024-3166
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm