CVE-2024-8248

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8248
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 Patch
https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*
History

15 Jul 2025, 15:16

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en la función normalizePath de mintplex-labs/anything-llm, versión git 296f041, permite path traversal, lo que provoca la lectura y escritura arbitraria de archivos en el directorio de almacenamiento. Esto puede provocar una escalada de privilegios de administrador a administrador. El problema se solucionó en la versión 1.2.2.
CPE cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*
First Time Mintplexlabs anythingllm
Mintplexlabs
References () https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 - () https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7 - Patch
References () https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e - () https://huntr.com/bounties/7d6c3b7a-1116-450d-b539-9c911a97537e - Exploit, Third Party Advisory

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-15 15:16

NVD link : CVE-2024-8248

Mitre link : CVE-2024-8248

CVE.ORG link : CVE-2024-8248

JSON object : View

Products Affected

mintplexlabs

  • anythingllm
CWE
CWE-29

Path Traversal: '\..\filename'