AVID-2026-R1391

Description

Path Traversal in mintplex-labs/anything-llm (CVE-2024-13059)

Details

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces ‘../’ sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.

Reason for inclusion in AVID: The CVE describes a path traversal vulnerability in mintplex-labs/anything-llm (an AI deployment/serving component). It is a software vulnerability (CWE-29) that enables arbitrary file write and potential remote code execution, exploitable in AI system deployment scenarios. The issue affects software used to build, package, deploy, and run general-purpose AI systems, i.e., a software supply-chain component for AI stacks. The report provides CVE details, CVSS metrics, and references, offering sufficient signal for AVID curation.

References

Affected or Relevant Artifacts

Developer: mintplex-labs
Deployer: mintplex-labs
Artifact Details:

Type	Name
System	mintplex-labs/anything-llm

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score	7.2
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🔴 High
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-29	CWE-29 Path Traversal: ‘..\filename’

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-02-10
Version: 0.3.3
AVID Entry