Critical AnythingLLM Vulnerability Enables Remote Code Execution

A critical vulnerability (CVE-2024-13059) in the open-source AI framework AnythingLLM was disclosed in February 2025, enabling attackers with administrative privileges to execute remote code on affected systems.

The flaw, rated high to critical severity (CVSS 7.2–9.1), impacts versions before 1.3.1 and stems from improper handling of non-ASCII filenames during file uploads.

Vulnerability Breakdown

According to thr report, the vulnerability arises from the multer middleware’s failure to sanitize directory traversal sequences (e.g., ../) in filenames containing non-ASCII characters.

When uploaded files are processed, attackers can manipulate filenames to write malicious files to unintended server locations.

For example, a filename like ../../malicious.sh this could place an executable script in a system directory, leading to remote code execution (RCE).

Key Risk Factors:

• Requires manager or admin privileges within AnythingLLM.
• Exploitable via arbitrary file write, potentially compromising confidentiality, integrity, and availability.
• Affects all deployments using versions below 1.3.1.

Exploitation Overview

Attackers can exploit this flaw in four steps:

1. Gain administrative access to a vulnerable AnythingLLM instance.
2. Craft a file with a non-ASCII filename containing traversal sequences (e.g., %c0%ae%c0%ae/evil.php).
3. Upload the file through the application’s interface.
4. Trigger execution by writing to directories like cron jobs or startup scripts.

Detection and Mitigation

Detection Methods:

• Log analysis: Monitor upload logs for filenames with ../ patterns.
• File integrity checks: Use tools like Tripwire to detect unauthorized file changes.
• Behavioral monitoring: Deploy intrusion detection systems (IDS) to flag unusual file access.

Mitigation Steps:

1. Immediate upgrade to AnythingLLM v1.3.1, which patches the vulnerability by sanitizing filenames.
2. Restrict file uploads to trusted users and validate filenames for traversal sequences.
3. Isolate application environments to limit lateral movement post-exploitation.

Industry Response

The vulnerability was patched in February 2025, with security firms like OffSec and Recorded Future emphasizing its criticality due to the rise in AI tool adoption.

Organizations are advised to prioritize updates, as unpatched systems remain vulnerable to RCE attacks targeting AI infrastructure.

This incident underscores the importance of rigorous input validation in file-handling workflows, particularly for AI-driven platforms with elevated access requirements.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates