CVE-2024-3025

CVE-2024-3025 is a critical path traversal vulnerability affecting mintplex-labs/anything-llm, stemming from insufficient validation of user-supplied logo filenames. This allows authenticated attackers to read or delete arbitrary files on the system by manipulating the filename to reference paths outside the intended directory. With a CVSS score of 9.9, the vulnerability is easily exploitable over the network with low privileges and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been reported, its high severity warrants immediate attention.