CVE-2024-13059
Last modified
CVE-2024-13059 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. EPSS estimates a 19.78% chance of exploitation in the next 30 days.
Description
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
Metrics
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mintplexlabs | Anythingllm | < 1.3.1 |
References
- https://huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1Exploit, Third Party Advisory
- https://huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-13059?
How severe is CVE-2024-13059?
How do I fix CVE-2024-13059?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-13053The Form Maker by 10Web WordPress plugin before 1.15.33 doe…4.8
- CVE-2024-13054An issue was discovered in GitLab CE/EE affecting all versio…6.5
- CVE-2024-13055The Dyn Business Panel WordPress plugin through 1.0.0 does n…7.1
- CVE-2024-13056The Dyn Business Panel WordPress plugin through 1.0.0 does n…7.1
- CVE-2024-13057The Dyn Business Panel WordPress plugin through 1.0.0 does n…7.1
- CVE-2024-13058An issue exists in SoftIron HyperCloud where authenticated,…4.8
- CVE-2024-1306The Smart Forms WordPress plugin before 2.6.94 does not hav…5.4
- CVE-2024-13060A vulnerability in AnythingLLM Docker version 1.3.1 allows u…4.3
- CVE-2024-13061The Electronic Official Document Management System from 2100…9.8
- CVE-2024-13062An unintended entry point vulnerability has been identified …7.2
- CVE-2024-13063Authorization Bypass Through User-Controlled Key vulnerabili…6.8
- CVE-2024-13064Improper Neutralization of Input During Web Page Generation …4.3
Are you affected by CVE-2024-13059?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST