CVE-2024-13059
moderate-risk
Published 2025-02-10
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
Do I need to act?
!
55.4% chance of exploitation in next 30 days
EPSS score — higher than 45% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10
High
NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
49
/ 100
moderate-risk
Severity
26/34 · High
Exploitability
18/34 · Moderate
Exposure
5/34 · Minimal