AnythingLLM CVE-2026-45403

Exploitation requires a high-privilege authenticated AnythingLLM account (PR:H per CVSS vector) - unauthenticated or low-privilege users cannot trigger the agent filesystem copy tool. The attacker must also have the ability to place a symbolic link inside a directory within the agent's permitted source path, and must actively invoke the copy operation (UI:R). The agent filesystem feature must be enabled in the deployment configuration. The vulnerability is read-only - it does not permit writing, modifying, or deleting files outside the sandbox (I:N/A:N), limiting exposure to confidential file contents. Exploitation is further bounded by host OS filesystem permissions: only files readable by the AnythingLLM process account are reachable via symlink traversal. Deployments where the process runs as a restricted OS user with access only to application-specific directories face minimal exposure even if exploited.

The CVSS 2.0 score with vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N reflects a tightly constrained threat profile. Three independent CVSS factors substantially limit real-world exploitability: the attacker must hold a high-privilege account (PR:H), the attack complexity is high (AC:H - requiring the ability to place a symlink in an agent-accessible directory), and user interaction is required (UI:R - the copy operation must be actively invoked). The impact is limited to partial confidentiality (C:L) with no integrity or availability effect. No EPSS score was included in the provided intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation. The primary risk scenario is insider threat or compromised high-privilege credential abuse rather than external attack. Risk is elevated relative to the raw score only in multi-tenant deployments where high-privilege AnythingLLM agent access is shared among mutually untrusted users and where the application process has filesystem access to sensitive files (e.g., .env files, SSH keys, TLS certificates) outside the agent sandbox root. Single-user or tightly access-controlled deployments face very low practical risk.

A high-privilege AnythingLLM user with agent filesystem access creates a symbolic link inside a directory the agent is permitted to copy from - for example, linking a file named secrets.txt inside the allowed source directory to /opt/anythingllm/.env on the host. The user then invokes the agent copy tool targeting that source directory; the recursive helper descends into the symlink entry, fs.stat() resolves it to the external .env file, and fs.copyFile() materializes the environment file's contents into an agent-accessible destination as a regular file. The user reads the exfiltrated credentials through the AnythingLLM interface, bypassing the intended filesystem sandbox. No public exploit code has been identified at time of analysis.