Anythingllm
CVE-2024-13059
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
AnalysisAI
AnythingLLM prior to version 1.3.1 contains a path traversal vulnerability through non-ASCII filename handling in the multer library. The filename transformation introduces ../ sequences that enable arbitrary file write, leading to remote code execution on the LLM application server.
Technical ContextAI
The multer library processes uploaded filenames containing non-ASCII characters. During filename normalization/transformation, certain character sequences are converted to '../' paths. This allows an attacker to write files outside the intended upload directory, including overwriting application files or creating new executable scripts.
RemediationAI
Update to AnythingLLM 1.3.1 or later. Implement filename sanitization that strips all path components. Use random filenames for uploads. Monitor application files for unexpected modifications.
Share
External POC / Exploit Code
Leaving vuln.today