Mintplex-labs vulnerabilities
77 CVEs and advisories name Mintplex-labs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-88055AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
- CVE-2026-72917AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
- CVE-2026-55611AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)
- CVE-2026-48789AnythingLLM: Windows path containment bypass in document folder route
- CVE-2026-47713AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration
- CVE-2026-48116AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
- CVE-2026-45403AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory
- CVE-2026-42456AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)
- CVE-2026-41318AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component
- CVE-2026-5627Path Traversal in mintplex-labs/anything-llm
- CVE-2026-32719AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
- CVE-2026-32717AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
- CVE-2026-32715AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences
- CVE-2026-32628AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
- CVE-2026-32626AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2026-32617AnythingLLM Permissable CORS policy
- CVE-2026-24478AnythingLLM vulnerable to Path Traversal
- CVE-2026-24477AnythingLLM has key leak in `systemSettings.js`
- CVE-2026-21484AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery
- CVE-2024-8196Missing Authentication for Critical Function in mintplex-labs/anything-llm
- CVE-2024-8248Path Traversal in mintplex-labs/anything-llm
- CVE-2024-6842Exposure of Sensitive Information in mintplex-labs/anything-llm
- CVE-2024-10513Path Traversal in mintplex-labs/anything-llm
- CVE-2024-8249Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
- CVE-2024-10109Incorrect Authorization in mintplex-labs/anything-llm
- CVE-2024-7771Denial of Service in mintplex-labs/anything-llm
- CVE-2024-8251Prisma Injection in mintplex-labs/anything-llm
- CVE-2024-13060Improper Authorization in mintplex-labs/anything-llm
- CVE-2024-13059Path Traversal in mintplex-labs/anything-llm
- CVE-2024-7783Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm