https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 10:47:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-161878 EUVD-2026-161878 https://cve.radiocsirt.org/vuln/euvd-2026-161878 https://cve.radiocsirt.org/vuln/fkie_cve-2024-3028 <p>mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the &#39;logo_filename&#39; parameter in the &#39;system-preferences&#39; API endpoint, an attacker can construct requests to read sensitive files or the application&#39;s &#39;.env&#39; file, and even delete files by setting the &#39;logo_filename&#39; to the path of the target file and invoking the &#39;remove-logo&#39; API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.</p> <p>mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the &#39;logo_filename&#39; parameter in the &#39;system-preferences&#39; API endpoint, an attacker can construct requests to read sensitive files or the application&#39;s &#39;.env&#39; file, and even delete files by setting the &#39;logo_filename&#39; to the path of the target file and invoking the &#39;remove-logo&#39; API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-3028 https://cve.radiocsirt.org/vuln/ghsa-jq5m-3v7c-39qm <p>mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the &#39;logo_filename&#39; parameter in the &#39;system-preferences&#39; API endpoint, an attacker can construct requests to read sensitive files or the application&#39;s &#39;.env&#39; file, and even delete files by setting the &#39;logo_filename&#39; to the path of the target file and invoking the &#39;remove-logo&#39; API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.</p> <p>mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the &#39;logo_filename&#39; parameter in the &#39;system-preferences&#39; API endpoint, an attacker can construct requests to read sensitive files or the application&#39;s &#39;.env&#39; file, and even delete files by setting the &#39;logo_filename&#39; to the path of the target file and invoking the &#39;remove-logo&#39; API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.</p> https://cve.radiocsirt.org/vuln/ghsa-jq5m-3v7c-39qm https://cve.radiocsirt.org/vuln/gsd-2024-3028 gsd-2024-3028 https://cve.radiocsirt.org/vuln/gsd-2024-3028