What’s Vulnerable › Vulnerabilities

CVE-2024-0763: Improper validation of document removal parameter

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-27 · updated 2026-06-17
• Weakness: CWE-22

Description

Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.

Affected products

• Mintplexlabs Anythingllm: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: Mintplexlabs Anythingllm 1.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
• https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5
• https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
• https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5

Get alerted when CVE-2024-0763 or the next vulnerability affects your stack