# Mintplexlabs Anythingllm


- [CVE-2024-3025](https://insights.sbomify.com/CVE-2024-3025/): Path Traversal in mintplex-labs/anything-llm (critical 9.9)
- [CVE-2024-0455](https://insights.sbomify.com/CVE-2024-0455/): SSRF on AWS deployed instances of AnythingLLM via /metadata (critical 9.9)
- [CVE-2026-32626](https://insights.sbomify.com/CVE-2026-32626/): AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection (critical 9.7)
- [CVE-2024-3104](https://insights.sbomify.com/CVE-2024-3104/): Remote Code Execution in mintplex-labs/anything-llm (critical 9.6)
- [CVE-2024-3149](https://insights.sbomify.com/CVE-2024-3149/): SSRF in mintplex-labs/anything-llm (critical 9.6)
- [CVE-2024-0765](https://insights.sbomify.com/CVE-2024-0765/): Default user role exporting save state of instance (critical 9.6)
- [CVE-2024-0550](https://insights.sbomify.com/CVE-2024-0550/): Privileged User using traversal to read system files (critical 9.6)
- [CVE-2024-0440](https://insights.sbomify.com/CVE-2024-0440/): SSRF - file:// unsanitized access to underlying host files (critical 9.6)
- [CVE-2026-5627](https://insights.sbomify.com/CVE-2026-5627/): Path Traversal in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2024-3279](https://insights.sbomify.com/CVE-2024-3279/): Improper Access Control in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2024-5211](https://insights.sbomify.com/CVE-2024-5211/): Path traversal in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2024-3033](https://insights.sbomify.com/CVE-2024-3033/): Improper Authorization in mintplex-labs/anything-llm (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/mintplexlabs/anythingllm/