Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Mintplex-Labs/anything-llm

              master @ bc71392
            

Fixes

CVEs

CRITICAL

Peak severity

28.9%

Coverage

Highlights

Path Traversal: 15 prior fixes. Scrutinize any change in this area.

server/endpoints/system.js: most-fixed (6 issues). Treat as high-risk during review.

37 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Dominant vulnerability class with 15 fixes across plugin loading, file upload/retrieval, exports, and profile pictures. Multiple distinct sinks (path.resolve, zip.extractAllTo, path.join, response.download) each required bespoke normalization, indicating systemic lack of a centralized safe-path helper.

Auth Bypass / Authorization Bypass: 13 fixes reveal inconsistent enforcement of authentication, role, and workspace-scoping checks across endpoints and middleware. Inverted allowlist logic, missing suspension checks, and route guards that allowed default users into admin pages show the authorization model is applied piecemeal.

IDOR: Four fixes add user_id filters to chat retrieval, feedback updates, and parsed-file operations. The repeated pattern of missing user scoping on workspace-owned resources indicates a systemic risk in the workspace data model.