Advisories · Technology
Mintplex-Labs anything-llm.
Every CVE that names Mintplex-Labs anything-llm among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.5 Medium
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
- Mintplex-Labs anything-llm
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
- Mintplex-Labs anything-llm
- Authentication bypass
- CWE-180
- CVSS 0.0 None
AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)
- Mintplex-Labs anything-llm
- Broken access control
- CVSS 4.3 Medium
AnythingLLM: Windows path containment bypass in document folder route
- Mintplex-Labs anything-llm
- Path traversal
- CVSS 2.0 Low
AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration
- Mintplex-Labs anything-llm
- Broken access control
- CVSS 7.5 High
AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
- Mintplex-Labs anything-llm
- Command injection
- CVSS 2.0 Low
AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory
- Mintplex-Labs anything-llm
- Path traversal
- CVSS 4.3 Medium
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)
- Mintplex-Labs anything-llm
- Information disclosure
- Broken access control
- CVSS 5.4 Medium
AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component
- Mintplex-Labs anything-llm
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-29
- CVSS 4.2 Medium
AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
- Mintplex-Labs anything-llm
- Path traversal
- Code injection
- CVSS 2.7 Low
AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
- Mintplex-Labs anything-llm
- Broken access control
- CVSS 3.8 Low
AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences
- Mintplex-Labs anything-llm
- Broken access control
- CVSS 7.7 High
AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
- Mintplex-Labs anything-llm
- SQL injection
- CVSS 9.7 CriticalCritical · CVSS 9+
AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- Mintplex-Labs anything-llm
- Cross-site scripting (XSS)
- CVSS 7.1 High
AnythingLLM Permissable CORS policy
- Mintplex-Labs anything-llm
- CWE-942
- CWE-1188
- CVSS 7.2 High
AnythingLLM vulnerable to Path Traversal
- Mintplex-Labs anything-llm
- Path traversal
- CVSS 8.7 High
AnythingLLM has key leak in `systemSettings.js`
- Mintplex-Labs anything-llm
- Information disclosure
- CVSS 5.3 Medium
AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
- Mintplex-Labs anything-llm
- Information disclosure
- CWE-204
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing Authentication for Critical Function in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Authentication bypass
- CVSS 7.2 High
Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-29
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Exposure of Sensitive Information in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Authentication bypass
- CVSS 7.2 High
Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Path traversal
- CVSS 7.5 High
Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-248
- CVSS 8.3 High
Incorrect Authorization in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Broken access control
- CVSS 6.5 Medium
Denial of Service in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Denial of service
- CVSS 5.3 Medium
Prisma Injection in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- SQL injection
- CVSS 4.3 Medium
Improper Authorization in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Broken access control
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-29
- CVSS 5.9 Medium
Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper Access Control in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Authentication bypass
- CVSS 7.5 High
Denial of Service in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Denial of service
- CVSS 5.3 Medium
Exposure of Sensitive Information in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Information disclosure
- CVSS 6.5 Medium
Uncontrolled Resource Consumption in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-29
- CVSS 8.1 High
Privilege Escalation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-755
- CVSS 9.6 CriticalCritical · CVSS 9+
SSRF in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Uncontrolled Resource Consumption in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Denial of service
- CVSS 3.4 Low
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
JSON Injection in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Authentication bypass
- CVSS 7.3 High
Stored XSS leading to admin account takeover in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
Remote Code Execution in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper Authorization in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Broken access control
- CVSS 8.8 High
Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Server-side request forgery (SSRF)
- CVSS 7.7 High
SSRF vulnerability in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
Improper Neutralization of Special Elements in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Code injection
- CVSS 8.1 High
Improper Input Validation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-20
- CVSS 4.9 Medium
Denial of Service in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Denial of service
- CVSS 6.5 Medium
Race Condition Vulnerability in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Race condition
- CVSS 9.0 CriticalCritical · CVSS 9+
Improper Input Validation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-20
- CVSS 8.1 High
Relative Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Path traversal
- CVSS 7.2 High
Improper Input Validation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
Mass Assignment Vulnerability in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Broken access control
- CVSS 0.0 None
Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Cross-site scripting (XSS)
- CVSS 6.7 Medium
Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- CWE-20
- CVSS 7.2 High
Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Broken access control
- CVSS 7.5 High
Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Denial of service
- CVSS 9.9 CriticalCritical · CVSS 9+
Path Traversal in mintplex-labs/anything-llm
- mintplex-labs/anything-llm
- Path traversal
- CVSS 9.6 CriticalCritical · CVSS 9+
Default user role exporting save state of instance
- mintplex-labs/anything-llm
- Information disclosure
- CVSS 7.2 High
Create user API role not enforced
- mintplex-labs/anything-llm
- Broken access control