CVE-2024-13059: Mintplexlabs Anythingllm Path Traversal

CVE-2024-13059 Overview

CVE-2024-13059 is a path traversal vulnerability in mintplex-labs/anything-llm versions prior to 1.3.1. The flaw stems from improper handling of non-ASCII filenames within the multer file upload middleware. When multer transforms non-ASCII filenames, the process can introduce ../ sequences that bypass sanitization. Authenticated users with manager or admin roles can exploit this to write arbitrary files to locations outside the intended upload directory. Successful exploitation can escalate to remote code execution (RCE) on the underlying server.

Critical Impact
Authenticated attackers with manager or admin roles can write files to arbitrary server locations, potentially achieving remote code execution and full compromise of the AnythingLLM host.

Affected Products

mintplex-labs anything-llm versions prior to 1.3.1
Deployments using the vulnerable multer upload handler in server/utils/files/multer.js
Self-hosted and containerized AnythingLLM instances exposing the upload API to authenticated users

Discovery Timeline

2025-02-10 - CVE-2024-13059 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13059

Vulnerability Analysis

The vulnerability resides in the file upload pipeline handled by the multer Node.js middleware. AnythingLLM accepts user-supplied filenames during upload without normalizing the resulting path. When a client submits a filename containing non-ASCII characters, multer performs an internal transformation that can produce path traversal sequences such as ../. These sequences are written to disk unaltered.

An attacker with manager or admin privileges can craft an upload request whose transformed filename escapes the intended upload directory. The attacker can place executable scripts, configuration files, or scheduled task definitions in privileged directories on the server. Because the AnythingLLM process typically has write access to its own runtime paths, an uploaded file that overwrites server code or configuration can be triggered to execute during normal application operation.

This issue is classified under [CWE-22] (Path Traversal) and [CWE-29] (Path Traversal: \..\filename).

Root Cause

The root cause is missing path normalization on filenames returned by multer after non-ASCII character transformation. The upload handler in server/utils/files/multer.js did not call a normalization routine before using the filename as part of the destination path. The fix introduces a normalizePath helper that strips traversal sequences before the file is committed to disk.

Attack Vector

Exploitation requires network access to the AnythingLLM API and valid credentials with the manager or admin role. The attacker submits a multipart upload containing a filename with crafted non-ASCII bytes that multer will translate into ../ segments. The server writes the payload to an attacker-chosen location. If the target path is within the Node.js execution scope or a directory reloaded by the application, the attacker can achieve RCE.

javascript

// Security patch in server/utils/files/multer.js
// Normalize paths on files uploaded to prevent arbitrary file writes (#2905)
 const path = require("path");
 const fs = require("fs");
 const { v4 } = require("uuid");
+const { normalizePath } = require(".");

 /**
  * Handle File uploads for auto-uploading.
// Source: https://github.com/mintplex-labs/anything-llm/commit/0b7bf68f2c02ca68075970fbf85d5a70ca5e94ca

The patch imports a normalizePath utility that must be applied to every uploaded filename before it is used as a destination component.

Detection Methods for CVE-2024-13059

Indicators of Compromise

Files present in AnythingLLM storage directories whose names or resolved paths contain ../, ..%2f, or decoded non-ASCII byte sequences that traverse directories.
Unexpected files written outside the standard upload directory, particularly in server/, collector/, or system directories.
Modifications to application source files, package.json, or startup scripts on AnythingLLM hosts without a corresponding deployment event.

Detection Strategies

Audit HTTP request logs for upload endpoints containing multipart filenames with non-ASCII characters or encoded traversal sequences.
Compare on-disk file inventories against the expected AnythingLLM installation manifest and flag any files outside allowed upload paths.
Review authentication logs for manager or admin sessions performing large or unusual upload volumes.

Monitoring Recommendations

Enable file integrity monitoring on the AnythingLLM installation directory and any writable runtime paths.
Alert on child process spawns originating from the Node.js AnythingLLM process that execute shells, interpreters, or unexpected binaries.
Track EPSS movement for CVE-2024-13059; the score of approximately 21.3% places it in the 97th percentile of likely-exploited vulnerabilities.

How to Mitigate CVE-2024-13059

Immediate Actions Required

Upgrade AnythingLLM to version 1.3.1 or later, which includes the normalizePath fix in server/utils/files/multer.js.
Rotate credentials for all manager and admin accounts and review recent role assignments for unauthorized privilege grants.
Inspect the AnythingLLM host for files written outside the upload directory since the vulnerable version was deployed.

Patch Information

The fix is delivered in commit 0b7bf68f2c02ca68075970fbf85d5a70ca5e94ca and merged as pull request #2905. The patch imports and applies a normalizePath helper to uploaded filenames before writing them to disk. Full details are available in the GitHub commit and the Huntr bug bounty report.

Workarounds

Restrict access to the AnythingLLM upload endpoints using a reverse proxy or firewall rules until patching is complete.
Limit the number of accounts assigned the manager or admin role and enforce strong authentication for those users.
Run the AnythingLLM process under a least-privilege service account without write access to system or application source directories.

bash

# Verify installed AnythingLLM version and upgrade
docker pull mintplexlabs/anythingllm:latest
docker stop anythingllm && docker rm anythingllm
# Re-deploy the container using the updated image (>= 1.3.1)

# Confirm the patched file references normalizePath
grep -n "normalizePath" server/utils/files/multer.js