CVE-2024-0763 is a high severity (CVSS 8.1) path traversal in Mintplex Labs AnythingLLM. A user who can reach a protected endpoint can delete an arbitrary folder recursively on the server because input is not sanitised. Update to a build that includes the upstream fix commit and review who holds accounts.
What's affected
AnythingLLM from Mintplex Labs. The record gives no version range. It says any user can delete an arbitrary folder, recursively, on the remote server, and that the attacker needs some privilege level because the endpoint requires authorization.
The references include the upstream fix commit (8a7324d) and a huntr bounty page. Because no fixed version number is in the record, check the project's release notes for the first release that contains that commit.
The record classifies the weakness as CWE-22 (path traversal). NVD scores it 8.1 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
How to check if you're exposed
If you run the Docker image, check which tag or digest is deployed with docker image ls and compare it with the project's published release notes. If you run from a git clone, check whether the fix commit is in your history:
git merge-base --is-ancestor 8a7324d0e77a15186e1ad5e5119fca4fb224c39c HEAD && echo patched
The command prints patched when the commit is part of your checked out history.
What to do now
- Find every AnythingLLM instance you run, including desktop, Docker and cloud deployments.
- Update to a release that includes upstream commit 8a7324d0e77a15186e1ad5e5119fca4fb224c39c. If you build from source, pull the latest main and rebuild.
- Review which accounts exist on each instance and remove those that are not needed. The endpoint requires authorization, so account hygiene reduces exposure.
- Back up the storage directory and confirm your restore process works. A recursive delete is a data loss event first.
Why it matters
Path traversal (CWE-22) happens when a user supplied name is joined to a base directory without checking that the result stays inside it. With a read operation the damage is disclosure. Here the operation is a recursive delete, so the same mistake destroys data instead.
The score is high rather than critical because the caller must already be authorised. In a shared or multi user deployment that is still a real concern, since any ordinary account could damage the whole storage area.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Is a login enough protection?
No. The record says an authorised user can trigger the delete. A login limits who can try, but it does not stop a legitimate low privilege account from doing harm.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
