Vulnerability details
CVE-2026-5627
Mintplex-Labs mintplex-labs/anything-llm
Path Traversal in mintplex-labs/anything-llm
CVSS 3.0
9.1Critical
Official description
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils/agentFlows/index.js`. Specifically, the combination of `path.join` and `normalizePath` allows attackers to bypass directory restrictions and access or delete arbitrary `.json` files on the server. This can lead to information disclosure, such as leaking sensitive configuration files containing API keys, or denial of service by deleting critical files like `package.json`. The issue is resolved in version 1.12.1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 3.0 | CVEProject cvelistV5 (CNA) (@huntr_ai) | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Mintplex-Labs | mintplex-labs/anything-llm | v < 1.12.1 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-07
- Last updated
- 2026-04-07
- State
- Published
- Assigner (CNA)
- @huntr_ai
Exploit prediction (EPSS)
0.82%
Probability of exploitation in 30 days
57.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-29Path Traversal: '\..\filename'