Mintplex Labs Anything Llm EUVD-2026-19637

Requires authenticated access as a high-privilege user (administrator) to Anything LLM versions up to 1.9.1. Attacker exploits path traversal in AgentFlows loadFlow and deleteFlow methods via malicious JSON file paths to access or delete arbitrary files containing API keys and configuration data.

The CVSS 9.1 (Critical) rating reflects severe potential impact with cross-scope consequences (S:C), but real-world exploitability is significantly constrained. The CVSS vector shows network-accessible (AV:N) with low complexity (AC:L), yet requires high privileges (PR:H) - specifically administrator-level access to the AgentFlows component. This authentication barrier substantially reduces the attack surface compared to unauthenticated vulnerabilities. No EPSS score is provided, and no public exploit identified at time of analysis, though technical details are available via the Huntr security bounty platform disclosure. The vulnerability is NOT listed in CISA KEV, indicating no confirmed active exploitation in the wild. From an SSVC perspective: exploitation requires administrator compromise (high barrier), but once achieved the attack is highly automatable (simple path traversal payload), with major technical impact (confidentiality breach of API keys, integrity/availability loss from file deletion). The critical information disclosure risk - leaking configuration files containing API keys for integrated LLM services - represents the primary business risk, as compromised credentials could enable lateral movement to cloud AI platforms. The denial-of-service vector (deleting package.json or other critical files) could disable the application entirely. Organizations should prioritize patching if anything-llm is exposed to untrusted administrators or if administrator accounts lack robust protection, but the requirement for pre-existing admin access makes this lower priority than comparably-scored unauthenticated vulnerabilities.

An attacker who has compromised an administrator account (through phishing, credential stuffing, or insider threat) authenticates to the anything-llm platform and navigates to the AgentFlows management interface. The attacker crafts a malicious API request to the loadFlow method with a payload like ../../../config/api-keys.json, bypassing the intended storage directory due to improper path sanitization. The server processes the traversal sequence and returns the contents of the configuration file, exposing OpenAI API keys, Anthropic credentials, and other integrated service secrets. Alternatively, the attacker uses deleteFlow with a payload targeting ../../../../package.json, causing the application to delete its own dependency manifest and crash on the next restart, achieving denial of service. The attacker then leverages the stolen API keys to access the organization's cloud LLM accounts, exfiltrating proprietary prompt data or running up fraudulent compute charges.