Mintplex Labs AnythingLLM 0.0.1
Approved changes feed: RSS · Atom
cpe:2.3:a:mintplexlabs:anythingllm:0.0.1:*:*:*:*:*:*:*
part: a version: 0.0.1 update: *
| Vendor | Mintplexlabs (668f36b8-0889-52f8-9874-ab5e2c6e8ad8) |
|---|---|
| Product | Anythingllm (0e10e5dc-a16a-5d19-8d77-26b867b1018f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-3152 |
vulnerable | 2026-06-08 06:41:52.585644 |
Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm
HIGH (8.8)
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the `/request-token`, `/workspace/:slug/thread/:threadSlug/update`, `/system/remove-logo`, `/system/logo`, and collector's `/process` endpoints. These issues are due to the application's failure to properly validate user input before passing it to `prisma` functions and other critical operations. Affected versions include the latest version prior to 1.0.0.
Published: 2024-06-06T17:19:15.397Z
Updated: 2025-10-15T12:50:23.189Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.