CVE-2024-10513: Mintplexlabs AnythingLLM Path Traversal

CVE-2024-10513 Overview

CVE-2024-10513 is a path traversal vulnerability in the document uploads manager feature of mintplex-labs/anything-llm, affecting versions prior to 1.2.2. The flaw resides in the /api/document/move-files endpoint, which fails to validate that source and destination paths remain within the intended documents directory. Authenticated users holding the manager role can move the anythingllm.db SQLite database to a publicly accessible directory, download its contents, and delete the original. Exploitation yields unauthorized access to sensitive data, credential material, and workspace configuration, enabling privilege escalation and data loss.

Critical Impact
A manager-level user can exfiltrate and destroy the application database through path traversal in /api/document/move-files, leading to full compromise of application data.

Affected Products

mintplex-labs anything-llm versions prior to 1.2.2
Self-hosted AnythingLLM deployments exposing the document API
Docker and desktop distributions built from the vulnerable commit range

Discovery Timeline

2025-03-20 - CVE-2024-10513 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10513

Vulnerability Analysis

The vulnerability is classified under [CWE-22] Path Traversal and [CWE-23] Relative Path Traversal. The /api/document/move-files endpoint accepts from and to path parameters and passes them to fs.rename after joining them with the documentsPath base directory. The endpoint applies normalizePath but does not verify that the resolved paths remain inside documentsPath. Traversal sequences such as ../ in either parameter escape the intended directory.

Because anythingllm.db stores user accounts, API keys, workspace settings, and embedded document metadata, moving it into a directory served by the frontend allows an attacker to download the full application state. Deleting the file after exfiltration disrupts service availability and forces reinitialization.

Root Cause

The move-files handler trusted user-controlled path segments. Normalization alone does not enforce a directory boundary. Without an explicit isWithin check, both the source and destination could resolve to arbitrary locations on the filesystem accessible to the Node.js process.

Attack Vector

Exploitation requires network access to the AnythingLLM API and valid manager role credentials. The attacker issues a POST to /api/document/move-files with from set to a traversal path pointing at anythingllm.db and to set to a public static asset directory. The attacker then requests the file over HTTP and issues a second move operation to remove evidence.

javascript

// Patch applied in server/endpoints/api/document/index.js
const sourcePath = path.join(documentsPath, normalizePath(from));
const destinationPath = path.join(documentsPath, normalizePath(to));
return new Promise((resolve, reject) => {
  if (
    !isWithin(documentsPath, sourcePath) ||
    !isWithin(documentsPath, destinationPath)
  )
    return reject("Invalid file location");

  fs.rename(sourcePath, destinationPath, (err) => {
    if (err) {
      console.error(`Error moving file ${from} to ${to}:`, err);
    }
  });
});

Source: mintplex-labs/anything-llm commit 47a5c71

Detection Methods for CVE-2024-10513

Indicators of Compromise

Requests to /api/document/move-files containing .. sequences or absolute paths in the from or to parameters
Unexpected appearance of anythingllm.db or database fragments under public asset directories such as frontend/dist or public/
Missing or renamed storage/anythingllm.db file on the AnythingLLM host
Outbound HTTP responses from AnythingLLM containing SQLite headers (SQLite format 3)

Detection Strategies

Inspect application and reverse-proxy logs for POST /api/document/move-files events tied to manager accounts and correlate with subsequent GET requests for uncommon file paths
Alert on filesystem events where anythingllm.db is renamed, moved, or deleted outside of an application upgrade window
Baseline the contents of the documents and static asset directories and flag deviations

Monitoring Recommendations

Enable audit logging for all administrative and manager API calls in AnythingLLM
Forward AnythingLLM container logs and host filesystem telemetry to a centralized SIEM for correlation
Track authentication events for manager role accounts and review anomalous session activity

How to Mitigate CVE-2024-10513

Immediate Actions Required

Upgrade AnythingLLM to version 1.2.2 or later, which introduces the isWithin boundary check on move operations
Rotate all API keys, workspace secrets, and user passwords stored in anythingllm.db if the vulnerable version was exposed
Audit accounts holding the manager role and revoke unused credentials
Restrict network exposure of the AnythingLLM API to trusted networks or place it behind an authenticated reverse proxy

Patch Information

The fix is delivered in commit 47a5c7126c20e2277ee56e2c7ee11990886a40a7. The patch adds an isWithin(documentsPath, ...) validation for both source and destination paths in the move-files handler, rejecting any request that resolves outside the documents directory. Additional bounty context is available in the Huntr disclosure.

Workarounds

Block or rate-limit /api/document/move-files at the reverse proxy until the upgrade is complete
Enforce filesystem permissions so the AnythingLLM process cannot write to web-served static directories
Store anythingllm.db on a separate mount with restrictive permissions and monitor for rename events

bash

# Verify AnythingLLM version and restrict move-files endpoint at the proxy
docker exec anythingllm cat /app/server/package.json | grep version

# Example nginx block to deny move-files until patched
location /api/document/move-files {
    deny all;
    return 403;
}