mintplex-labs vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-48116 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.High 7.5 · May 28, 2026
• CVE-2026-5627 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component.High 7.2 · Apr 7, 2026
• CVE-2026-32628 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.High 7.7 · Mar 16, 2026
• CVE-2026-32626 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.Critical 9.6 · Mar 16, 2026
• CVE-2026-32617 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.High 7.1 · Mar 16, 2026
• CVE-2026-24477 AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.High 8.7 · Jan 26, 2026
• CVE-2024-8249 mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionalitHigh 7.5 · Mar 20, 2025
• CVE-2024-8248 A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and wrHigh 7.2 · Mar 20, 2025
• CVE-2024-8196 In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default.Critical 9.8 · Mar 20, 2025
• CVE-2024-6842 In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings.High 7.5 · Mar 20, 2025
• CVE-2024-10513 A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2.High 7.2 · Mar 20, 2025
• CVE-2024-10109 A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/systemHigh 8.3 · Mar 20, 2025
• CVE-2024-13059 A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer libHigh 7.2 · Feb 10, 2025
• CVE-2024-7783 mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSONHigh 7.5 · Oct 29, 2024
• CVE-2024-3279 An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint.Critical 9.1 · Aug 12, 2024
• CVE-2024-5216 A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption.High 7.5 · Jun 25, 2024
• CVE-2024-5211 A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversHigh 7.2 · Jun 12, 2024
• CVE-2024-3166 A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of Critical 9.6 · Jun 6, 2024
• CVE-2024-3150 In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges High 8.8 · Jun 6, 2024
• CVE-2024-3149 A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm.High 8.8 · Jun 6, 2024
• CVE-2024-3110 A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest beforeHigh 8.7 · Jun 6, 2024
• CVE-2024-3152 mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints.High 8.8 · Jun 6, 2024
• CVE-2024-3104 A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables.Critical 9.8 · Jun 6, 2024
• CVE-2024-3033 An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes.Critical 9.4 · Jun 6, 2024
• CVE-2024-4084 A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intHigh 7.5 · Jun 4, 2024