CVE-2024-3028

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.

• CWE-20

• https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5cePatch
• https://huntr.com/bounties/41016b86-eabb-4161-ac81-40a1ca8e82acExploit, Third Party Advisory
• https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5cePatch
• https://huntr.com/bounties/41016b86-eabb-4161-ac81-40a1ca8e82acExploit, Third Party Advisory

Published

Apr 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30273Illustrator versions 28.3, 27.9.2 and earlier are affected b…7.8
• CVE-2024-30274Substance3D - Painter versions 9.1.2 and earlier are affecte…7.8
• CVE-2024-30275Adobe Aero Desktop versions 23.4 and earlier are affected by…7.8
• CVE-2024-30276Audition versions 24.2, 23.6.4 and earlier Answer: are affec…5.5
• CVE-2024-30278Media Encoder versions 23.6.5, 24.3 and earlier Answer: are …5.5
• CVE-2024-30279Acrobat Reader versions 20.005.30574, 24.002.20736 and earli…7.8
• CVE-2024-30280Acrobat Reader versions 20.005.30574, 24.002.20736 and earli…7.8
• CVE-2024-30281Substance3D - Designer versions 13.1.1 and earlier Answer: a…5.5
• CVE-2024-30282Animate versions 24.0.2, 23.0.5 and earlier are affected by …7.8
• CVE-2024-30283Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer:…5.5
• CVE-2024-30284Acrobat Reader versions 20.005.30574, 24.002.20736 and earli…7.8
• CVE-2024-30285Audition versions 24.2, 23.6.4 and earlier are affected by a…5.5