What is the CVSS score of CVE-2024-13059?

CVE-2024-13059 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 55.4%.

Which versions of Anythingllm are affected by CVE-2024-13059?

Organizations using mintplex-labs/anything-llm face moderate risk from CVE-2024-13059 rated CVSS 7.2. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2024-13059?

Yes, a public proof-of-concept exploit is available for CVE-2024-13059. Prioritise patching immediately. EPSS: 55.4%.

How to fix or mitigate CVE-2024-13059?

Within 30 days: Identify all affected systems running mintplex-labs/anything-llm and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Anythingllm CVE-2024-13059

HIGH

Path Traversal: '\\..\\filename' (CWE-29)

2025-02-10 security@huntr.dev

RCE Path Traversal Anythingllm

7.2

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:25 vuln.today

Patch released

Mar 28, 2026 - 18:25 nvd

Patch available

PoC Detected

Jul 09, 2025 - 15:11 vuln.today

Public exploit code

CVE Published

Feb 10, 2025 - 19:15 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.

AnalysisAI

AnythingLLM prior to version 1.3.1 contains a path traversal vulnerability through non-ASCII filename handling in the multer library. The filename transformation introduces ../ sequences that enable arbitrary file write, leading to remote code execution on the LLM application server.

Technical ContextAI

The multer library processes uploaded filenames containing non-ASCII characters. During filename normalization/transformation, certain character sequences are converted to '../' paths. This allows an attacker to write files outside the intended upload directory, including overwriting application files or creating new executable scripts.

RemediationAI

Update to AnythingLLM 1.3.1 or later. Implement filename sanitization that strips all path components. Use random filenames for uploads. Monitor application files for unexpected modifications.