Path Traversal Vulnerability in Document Uploads Manager
A path traversal vulnerability in the document uploads manager feature of the latest version of the software allows users with 'manager' roles to access and delete the 'anythingllm.db' database file. This issue was patched in version 1.2.2.
Available publicly on Jul 31 2024
Remediation Steps
- Update to version 1.2.2 or later.
- Implement strict validation to ensure that file movements are restricted to the 'documents' directory.
- Regularly audit and test endpoints for path traversal vulnerabilities.
- Ensure that sensitive files like 'anythingllm.db' are stored in directories that are not accessible via the web server.
Patch Details
- Fixed Version: 1.2.2
- Patch Commit: https://github.com/mintplex-labs/anything-llm/commit/47a5c7126c20e2277ee56e2c7ee11990886a40a7
Want more out of Sightline?
Sightline offers even more for premium customers
Go Premium
We have - related security advisories that are available with Sightline Premium.