Description (CNA)
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| mintplex-labs / mintplex-labs/anything-llm | affected unspecified before 1.0.0 |
CWE
CWE-23
References
- https://huntr.com/bounties/c6afeb5e-f211-4b3d-aa4b-6bad734217a6
- https://github.com/mintplex-labs/anything-llm/commit/e1dcd5ded010b03abd6aa32d1bf0668a48e38e17
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.