Path traversal in mintplex-labs/anything-llm (CVE-2024-10513)
Date: 2024
Affected: mintplex-labs/anything-llm <1.2.2
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical

anything-llm <1.2.2 document-uploads manager endpoint /api/document/move-files allows attackers to move the database file to a publicly accessible directory, leading to unauthorized data access and privilege escalation.


Mitigations:

Architectural layers (MAESTRO):