Anything Llm CVE-2026-32717

SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulne

Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high sev

XSS in AnythingLLM 1.11.1 and earlier.

SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a

AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where th

Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject

Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import f

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing

Symlink following in the AnythingLLM agent filesystem copy tool (versions prior to 1.13.0) allows a highly-privileged au