anything-llm · threatengine.sh

Home/Product/mintplexlabs anythingllm

Product

mintplexlabs anythingllm

66 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior

A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the AgentFlows co

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.1

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.1

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.1

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.1

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.1

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.1

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If Any

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to imp

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endp

mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for th

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading

A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of servi

In version 1.5.5 of mintplex-labs/anything-llm, the /setup-complete API endpoint allows unauthorized users to access sensitive s

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the lates

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensi

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASC

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improp

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endp

A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumpt

In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is ret

An uncontrolled resource consumption vulnerability exists in the upload-link endpoint of mintplex-labs/anything-llm. This vulner

A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the normalizePath() function, intended

mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading

In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature,

A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to a

A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter

mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An att

A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Atta

An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' en

A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers

In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifical

A vulnerability in mintplex-labs/anything-llm allows for a denial of service (DoS) condition through the modification of a user's

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/syst

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on th

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role

A mass assignment vulnerability exists in the /api/invite/:code endpoint of the mintplex-labs/anything-llm repository, allowing

A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, a

A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'ju

A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the lo

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system a

If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would preven

A user who is privileged already manager or admin can set their profile picture via the frontend API using a relative filepath

Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal.

Enable exports of the database and associated exported information of the system via the default user role. The attacked would hav

Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of ma

A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents

The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then

As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role

Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection

User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Give

AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as referenc

Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.

Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.

SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin