EUVD-2026-39008Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
DeliveryCraft HTTP request with encoded Windows absolute path or path.relative() parent segment
-
ExploitSubmit to document folder listing endpoint
-
ExecutionBypass POSIX-only path containment check
-
ImpactReceive directory listing outside documents folder
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concurrent conditions: a valid low-privilege authenticated session against the AnythingLLM instance (CVSS PR:L - unauthenticated access is not sufficient), a Windows-based deployment of AnythingLLM (the bypass is caused specifically by how Node.js path.relative() formats paths on Windows using backslashes and bare '..' segments), and network-level access to the document folder listing API endpoint. The vulnerability does NOT trigger on Linux or macOS, where path.relative() produces POSIX-formatted output that the existing check handles correctly. Impact is limited to read-only directory listing disclosure - no file content is returned, no write operations are possible, and no code execution is implied by this vector. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N scores 4.3 (Medium), which is an accurate reflection of real-world risk. Network reachability and low complexity are offset by the authentication requirement (PR:L) and Windows-only exploitability - the vulnerability does not manifest on Linux or macOS deployments due to POSIX path handling. Impact is strictly limited to directory listing disclosure (C:L); no integrity or availability impact is present (I:N/A:N). No EPSS score was provided in the input data, so exploitation probability cannot be quantified against the broader vulnerability population. KEV status is absent and no public POC has been identified, both consistent with limited real-world exploitation interest. The net assessment is: low operational urgency for most environments, elevated only for organizations running AnythingLLM on Windows where untrusted authenticated users have API access. |
| Exploit ScenarioDerived | An authenticated low-privilege user crafts an HTTP request to the AnythingLLM document listing endpoint, supplying an encoded absolute Windows path such as 'C:\Windows\System32' or a path.relative()-style '..' segment targeting a parent directory. The path containment helper passes the input because it only checks for POSIX-style '../' sequences. The response returns a directory listing for a location outside the intended documents folder, potentially revealing sensitive file and folder names on the Windows host. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to enumerate directories outside the intended documents directory. The root cause is a platform-specific gap in the shared path containment helper: it correctly rejects POSIX-style '../' sequences but fails to reject Windows-style parent path segments produced by Node.js path.relative(), such as bare '..'. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, consistent with the Medium CVSS score of 4.3 and the authentication requirement.
RemediationAI
Upgrade AnythingLLM to version 1.13.0 or later, which contains the vendor-released patch correcting the Windows-specific path containment logic. The fix is documented in the GitHub security advisory at https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-j4m9-wwcq-m868. For organizations unable to upgrade immediately, migrating the deployment to Linux or macOS eliminates the vulnerability entirely, as the POSIX path handling used on those platforms does not produce the Windows-style '..' segments that bypass the guard. If hosting changes are not feasible, restrict access to the document folder listing API endpoint to fully trusted, internally managed accounts, and block external network access to that route at the application gateway or firewall layer - accepting the trade-off that this may break legitimate folder browsing workflows for remote users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AnythingLLM (Mintplex-Labs) is a Node.js application that converts content into LLM context. The document folder listing route accepts a user-supplied path and validates it using a shared path containment helper. On Windows, Node.js path.relative() returns backslash-delimited paths with Windows-style '..' parent segments rather than the POSIX '../' that the sanitization logic checks for. This OS-level path representation difference means encoded absolute Windows paths (e.g., 'C:\Users\...') or relative paths constructed via path.relative() bypass the guard entirely, landing squarely in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CPE cpe:2.3:a:mintplex-labs:anything-llm:*:*:*:*:*:*:*:* covers all versions of the product up to but not including 1.13.0.
Know when Anything Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint requires low-privilege authentication; impact is read-only directory listing disclosure with no integrity, availability, or scope-change consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the document folder listing route can accept an encoded absolute Windows path that resolves outside the intended documents directory. The shared path containment helper rejects POSIX-style "../" traversal but does not reject Windows-style parent paths returned by path.relative(), such as "..". This vulnerability is fixed in 1.13.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Anything Llm
View allSQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulne
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high sev
XSS in AnythingLLM 1.11.1 and earlier.
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an ag
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where th
Stored XSS in AnythingLLM 1.16.1 and earlier enables a manager-role user to inject arbitrary JavaScript into the applica
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject
Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing
AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import f
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
Exploit-DB