CVE-2024-0763: Mintplexlabs AnythingLLM Path Traversal

CVE-2024-0763 Overview

CVE-2024-0763 is a path traversal vulnerability in Mintplex Labs AnythingLLM. The flaw stems from insufficient input sanitization in a document management endpoint. An authenticated user can supply crafted path input and recursively delete arbitrary folders on the remote server. Because the vulnerable endpoint requires authorization, an attacker must first obtain valid credentials at any privilege level. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Any authenticated user can recursively delete arbitrary directories on the AnythingLLM host, destroying application data, configuration files, and potentially system files accessible to the server process.

Affected Products

Mintplex Labs AnythingLLM (versions prior to the fix in commit 8a7324d)
Self-hosted AnythingLLM deployments exposing the document API
Multi-tenant AnythingLLM instances where non-admin users hold valid sessions

Discovery Timeline

2024-02-27 - CVE-2024-0763 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0763

Vulnerability Analysis

AnythingLLM exposes document management routes that accept user-supplied folder and filename parameters. The purgeDocument and purgeFolder helpers in server/utils/files/purgeDocument.js pass those parameters into filesystem operations without validating that the resolved path stays within the intended documents directory.

An attacker who authenticates to the application can supply a value containing directory traversal sequences such as ../. The server resolves the path outside the documents root and performs a recursive delete on the target directory. This yields loss of integrity and availability without requiring administrator privileges.

Root Cause

The vulnerable code invokes filesystem removal without normalizing the user-supplied path or asserting containment within the documents directory. The patch introduces isWithin and documentsPath helpers and calls normalizePath(filename) as a precondition, rejecting any input that resolves outside the expected root.

Attack Vector

Exploitation requires network access to the AnythingLLM API and any authenticated session. The attacker issues a request to the document purge endpoint with a folderName or filename containing ../ sequences. The server resolves the traversal and executes a recursive delete against the attacker-chosen path.

javascript

 const fs = require("fs");
 const path = require("path");
-const { purgeVectorCache, purgeSourceDocument, normalizePath } = require(".");
+const {
+  purgeVectorCache,
+  purgeSourceDocument,
+  normalizePath,
+  isWithin,
+  documentsPath,
+} = require(".");
 const { Document } = require("../../models/documents");
 const { Workspace } = require("../../models/workspace");

-async function purgeDocument(filename) {
+async function purgeDocument(filename = null) {
+  if (!filename || !normalizePath(filename)) return;
+
+  await purgeVectorCache(filename);
+  await purgeSourceDocument(filename);
   const workspaces = await Workspace.where();
   for (const workspace of workspaces) {
     await Document.removeDocuments(workspace, [filename]);
   }
-  await purgeVectorCache(filename);
-  await purgeSourceDocument(filename);
   return;
 }

-async function purgeFolder(folderName) {
-  if (folderName === "custom-documents") return;

Source: Mintplex Labs security patch commit 8a7324d

Detection Methods for CVE-2024-0763

Indicators of Compromise

HTTP requests to AnythingLLM document endpoints containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Unexpected deletion of directories under the AnythingLLM data root or adjacent filesystem paths
AnythingLLM process logs showing purgeDocument or purgeFolder calls with paths outside the documents directory
Authenticated API activity from low-privilege accounts targeting document purge routes at abnormal rates

Detection Strategies

Inspect reverse proxy and application access logs for traversal patterns in request bodies and query parameters directed at AnythingLLM APIs
Alert on filesystem delete events originating from the AnythingLLM service account outside the documents directory
Correlate authentication events with subsequent document-management API calls to identify low-privilege accounts probing purge endpoints

Monitoring Recommendations

Enable verbose application logging for all document lifecycle operations, including the resolved absolute path
Baseline normal request volumes to /api/document and /api/workspace routes and alert on deviations
Track file integrity for the AnythingLLM installation directory and any mounted document volumes

How to Mitigate CVE-2024-0763

Immediate Actions Required

Upgrade AnythingLLM to a release containing commit 8a7324d0e77a15186e1ad5e5119fca4fb224c39c or later
Audit user accounts and revoke sessions for any users that should not have document management permissions
Restore any directories deleted through suspicious API activity from backups and validate application integrity

Patch Information

Mintplex Labs remediated the issue in commit 8a7324d, which adds strict path validation using normalizePath, isWithin, and a canonical documentsPath. The bounty details are documented on the Huntr bounty listing. Redeploy the container or Node.js service after pulling the fixed version.

Workarounds

Restrict AnythingLLM network exposure to trusted networks or place it behind an authenticating reverse proxy with request filtering
Run the AnythingLLM process as a low-privilege user with filesystem access limited to the documents directory using mount namespaces or container volume scoping
Enforce least-privilege user roles and disable self-registration until the patched version is deployed

bash

# Pull the patched AnythingLLM source and rebuild
git clone https://github.com/mintplex-labs/anything-llm.git
cd anything-llm
git checkout 8a7324d0e77a15186e1ad5e5119fca4fb224c39c
yarn install && yarn prod:server

# Constrain the service account filesystem scope (systemd example)
# /etc/systemd/system/anythingllm.service.d/hardening.conf
[Service]
ReadWritePaths=/var/lib/anythingllm/documents
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true