Skip to content
Mintplex-labs Anything-llm vulnerabilities
-
mintplex-labs anything-llm
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
CVE-2026-88055
5.5 Medium
-
mintplex-labs anything-llm
AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
CVE-2026-72917
5.9 Medium
-
mintplex-labs anything-llm
AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)
CVE-2026-55611
0.0 None
-
mintplex-labs anything-llm
AnythingLLM: Windows path containment bypass in document folder route
CVE-2026-48789
4.3 Medium
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration
CVE-2026-47713
2.0 Low
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
CVE-2026-48116
7.5 High
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory
CVE-2026-45403
2.0 Low
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)
CVE-2026-42456
4.3 Medium
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component
CVE-2026-41318
5.4 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Path Traversal in mintplex-labs/anything-llm
CVE-2026-5627
9.1 Critical
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
CVE-2026-32719
4.2 Medium
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
CVE-2026-32717
2.7 Low
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences
CVE-2026-32715
3.8 Low
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
CVE-2026-32628
7.7 High
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
CVE-2026-32626
9.7 Critical
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM Permissable CORS policy
CVE-2026-32617
7.1 High
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM vulnerable to Path Traversal
CVE-2026-24478
7.2 High
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM has key leak in `systemSettings.js`
CVE-2026-24477
8.7 High
-
mintplexlabs anythingllm, mintplex-labs anything-llm +1 more
AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
CVE-2026-21484
5.3 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm desktop +1 more
Missing Authentication for Critical Function in mintplex-labs/anything-llm
CVE-2024-8196
9.8 Critical
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Path Traversal in mintplex-labs/anything-llm
CVE-2024-8248
7.2 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Exposure of Sensitive Information in mintplex-labs/anything-llm
CVE-2024-6842
EPSS 36.3%
7.5 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Path Traversal in mintplex-labs/anything-llm
CVE-2024-10513
7.2 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
CVE-2024-8249
7.5 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Incorrect Authorization in mintplex-labs/anything-llm
CVE-2024-10109
8.3 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Denial of Service in mintplex-labs/anything-llm
CVE-2024-7771
6.5 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Prisma Injection in mintplex-labs/anything-llm
CVE-2024-8251
5.3 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm docker +1 more
Improper Authorization in mintplex-labs/anything-llm
CVE-2024-13060
4.3 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Path Traversal in mintplex-labs/anything-llm
CVE-2024-13059
EPSS 24.3%
7.2 High
-
mintplex-labs mintplex-labs/anything-llm, miniplex labs labs\/anything lim, mintplexlabs anythingllm +2 more
Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm
CVE-2024-7783
5.9 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Improper Access Control in mintplex-labs/anything-llm
CVE-2024-3279
9.1 Critical
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Denial of Service in mintplex-labs/anything-llm
CVE-2024-5216
7.5 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Exposure of Sensitive Information in mintplex-labs/anything-llm
CVE-2024-5213
5.3 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Uncontrolled Resource Consumption in mintplex-labs/anything-llm
CVE-2024-5208
6.5 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm
CVE-2024-5211
9.1 Critical
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anything-llm, anythingllm +2 more
Privilege Escalation in mintplex-labs/anything-llm
CVE-2024-3150
8.1 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
SSRF in mintplex-labs/anything-llm
CVE-2024-3149
9.6 Critical
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Uncontrolled Resource Consumption in mintplex-labs/anything-llm
CVE-2024-3153
6.5 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm desktop, anythingllm docker +2 more
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm
CVE-2024-3166
3.4 Low
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
JSON Injection in mintplex-labs/anything-llm
CVE-2024-3102
5.3 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Stored XSS leading to admin account takeover in mintplex-labs/anything-llm
CVE-2024-3110
7.3 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Remote Code Execution in mintplex-labs/anything-llm
CVE-2024-3104
9.6 Critical
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Improper Authorization in mintplex-labs/anything-llm
CVE-2024-3033
9.1 Critical
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm
CVE-2024-3152
8.8 High
-
mintplex-labs mintplex-labs/anything-llm, mintplex-labs\/anything-llm, mintplexlabs anythingllm +2 more
SSRF vulnerability in mintplex-labs/anything-llm
CVE-2024-4084
7.7 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Improper Neutralization of Special Elements in mintplex-labs/anything-llm
CVE-2024-4286
4.9 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Improper Input Validation in mintplex-labs/anything-llm
CVE-2024-4287
8.1 High
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Denial of Service in mintplex-labs/anything-llm
CVE-2024-4284
4.9 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm, multiplex-labs +2 more
Race Condition Vulnerability in mintplex-labs/anything-llm
CVE-2024-2913
6.5 Medium
-
mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 more
Improper Input Validation in mintplex-labs/anything-llm
CVE-2024-3029
9.0 Critical
- Show olderLoading…