Path Traversal in mintplex-labs/anything-llm

Remote Code Execution in mintplex-labs/anything-llm

Relative Path Traversal in mintplex-labs/anything-llm

AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection

Improper Authorization in mintplex-labs/anything-llm

Improper Access Control in mintplex-labs/anything-llm

Mass Assignment Vulnerability in mintplex-labs/anything-llm

Improper Input Validation in mintplex-labs/anything-llm

AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter

Privilege Escalation in mintplex-labs/anything-llm

SSRF in mintplex-labs/anything-llm

Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm

User can manually send request at manager permission to modify system configurations

Improper Access Control in mintplex-labs/anything-llm

Stored XSS leading to admin account takeover in mintplex-labs/anything-llm

Incorrect Authorization in mintplex-labs/anything-llm

Relative Path Traversal in mintplex-labs/anything-llm

Improper validation of document removal parameter

Improper Input Validation in mintplex-labs/anything-llm

AnythingLLM Permissable CORS policy

AnythingLLM has key leak in `systemSettings.js`

Exposure of Sensitive Information in mintplex-labs/anything-llm

Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm

Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm

Denial of Service in mintplex-labs/anything-llm

SSRF vulnerability in mintplex-labs/anything-llm

Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm

Collection of internally resolving IPs

SSRF on AWS deployed instances of AnythingLLM via /metadata

Unauthenticated Denial of Service (DOS) attack in AnythingLLM

Path Traversal in mintplex-labs/anything-llm

AnythingLLM vulnerable to Path Traversal

Path Traversal in mintplex-labs/anything-llm

Path Traversal in mintplex-labs/anything-llm

Path Traversal in mintplex-labs/anything-llm

Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm

Improper Input Validation in mintplex-labs/anything-llm

Improper Input Validation in mintplex-labs/anything-llm

Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm

Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm

Create user API role not enforced

Download and export of file via default user role

Denial of Service in mintplex-labs/anything-llm

Exposure of Sensitive Information in mintplex-labs/anything-llm

Uncontrolled Resource Consumption in mintplex-labs/anything-llm

Uncontrolled Resource Consumption in mintplex-labs/anything-llm

Race Condition Vulnerability in mintplex-labs/anything-llm

Default user role exporting save state of instance

Privileged User using traversal to read system files