AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)
AnythingLLM's logo upload and fetch endpoints did not check filenames properly, so an attacker could use '../' sequences to escape the intended folder and reach any file on the server. The main target is the app's own SQLite database, which stores accounts, settings, and other sensitive data.
How the attack works
An attacker who already has an authenticated account sends a filename containing path-traversal sequences like '../../../' (or its URL-encoded form '%2e%2e%2f') to the /api/system/upload-logo or /api/system/logo endpoint. Because the server does not normalize or validate the path, it resolves outside the intended assets folder. This lets the attacker read or delete files elsewhere on disk, notably storage/anythingllm.db, the application's SQLite database. The vendor fixed this in version 1.0.0 by adding a normalizePath() check.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e4d0caea-3972-4d44-8910-48dd0cc71a7f
- Severity
- Critical
- CVEs
- CVE-2024-3025
Why it matters
An attacker can exfiltrate or destroy the AnythingLLM database, exposing or wiping stored credentials, configuration, and other application data, and potentially read or delete other files reachable from the server process.
What you can do
- →Upgrade AnythingLLM to version 1.0.0 or later, which validates and normalizes the logo filename.
- →Until upgraded, restrict access to the /api/system/upload-logo and /api/system/logo endpoints to trusted administrators only.
- →Review authentication requirements and limit which accounts can reach system-level endpoints.
- →Monitor logo endpoint requests for filenames containing '../' or its encoded form '%2e%2e%2f', and back up storage/anythingllm.db regularly in case of tampering.
Known benign look-alikes
- Legitimate logo upload/fetch hitting /api/system/upload-logo or /api/system/logo with a normal filename like my-logo.png and no ../ sequence.
- Documentation or changelog mentioning the logo endpoints without a traversal payload.