AnythingLLM CVE-2025-63390

No special conditions - remote unauthenticated exploitation against default configurations of AnythingLLM v1.8.5, because the /api/workspaces endpoint performs no authentication check (CWE-306). The practical limiting factors are: the instance must be network-reachable by the attacker (exposure is far higher for internet-facing deployments than for internal/localhost-only installs), only version 1.8.5 is confirmed affected per the CPE, and impact is confined to read-only disclosure of workspace configuration/system-prompt metadata - no authentication, user interaction, or non-default feature toggle is required, and no write, deletion, or code execution is possible through this flaw.

This is a genuine but moderate-severity information-disclosure issue, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N = 5.3, Medium) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated flaw whose only impact is limited confidentiality (read-only exposure of workspace metadata). There is no integrity or availability impact and no code execution - the attacker learns configuration data but cannot modify or crash the system. The EPSS score of 0.55% (45th percentile) is modest and reinforces that broad opportunistic exploitation is not currently predicted. This CVE is NOT on CISA KEV and there is no evidence of active exploitation. The three references (two gists authored by researcher Cristliu plus the project's GitHub issues page) strongly suggest that a public write-up and likely proof-of-concept exist, but the raw input provides no explicit POC=YES flag and the gist contents were not independently verified here. Signals are broadly aligned rather than conflicting: low CVSS, low EPSS, no KEV. The main real-world concern is that exposed system prompts (openAiPrompt) and AI/model configuration can aid reconnaissance or prompt-injection targeting of a self-hosted AI deployment, so internet-exposed AnythingLLM 1.8.5 instances should be patched or access-restricted, but this does not rise to emergency priority.

An attacker who can reach an internet-exposed AnythingLLM v1.8.5 instance sends an unauthenticated HTTP GET to /api/workspaces and receives a full dump of every workspace's identifiers, model/provider configuration, operational parameters, and system prompts. The leaked system prompts and vector/chat settings are then used to profile the deployment and craft targeted prompt-injection or social-engineering follow-up. Referenced public gists appear to document the request and response, lowering the skill needed, though no CISA-confirmed exploitation exists.