EUVD-2026-39008Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint requires low-privilege authentication; impact is read-only directory listing disclosure with no integrity, availability, or scope-change consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the document folder listing route can accept an encoded absolute Windows path that resolves outside the intended documents directory. The shared path containment helper rejects POSIX-style "../" traversal but does not reject Windows-style parent paths returned by path.relative(), such as "..". This vulnerability is fixed in 1.13.0.
AnalysisAI
Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to enumerate directories outside the intended documents directory. The root cause is a platform-specific gap in the shared path containment helper: it correctly rejects POSIX-style '../' sequences but fails to reject Windows-style parent path segments produced by Node.js path.relative(), such as bare '..'. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, consistent with the Medium CVSS score of 4.3 and the authentication requirement.
Technical ContextAI
AnythingLLM (Mintplex-Labs) is a Node.js application that converts content into LLM context. The document folder listing route accepts a user-supplied path and validates it using a shared path containment helper. On Windows, Node.js path.relative() returns backslash-delimited paths with Windows-style '..' parent segments rather than the POSIX '../' that the sanitization logic checks for. This OS-level path representation difference means encoded absolute Windows paths (e.g., 'C:\Users\...') or relative paths constructed via path.relative() bypass the guard entirely, landing squarely in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CPE cpe:2.3:a:mintplex-labs:anything-llm:*:*:*:*:*:*:*:* covers all versions of the product up to but not including 1.13.0.
RemediationAI
Upgrade AnythingLLM to version 1.13.0 or later, which contains the vendor-released patch correcting the Windows-specific path containment logic. The fix is documented in the GitHub security advisory at https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-j4m9-wwcq-m868. For organizations unable to upgrade immediately, migrating the deployment to Linux or macOS eliminates the vulnerability entirely, as the POSIX path handling used on those platforms does not produce the Windows-style '..' segments that bypass the guard. If hosting changes are not feasible, restrict access to the document folder listing API endpoint to fully trusted, internally managed accounts, and block external network access to that route at the application gateway or firewall layer - accepting the trade-off that this may break legitimate folder browsing workflows for remote users.
More in Anything Llm
View allSQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulne
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high sev
XSS in AnythingLLM 1.11.1 and earlier.
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an ag
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where th
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject
Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing
AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import f
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today