CVE-2026-5627— Path Traversal in mintplex-labs/anything-llm
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-5627
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in mintplex-labs/anything-llm
Source: NVD (National Vulnerability Database)
Vulnerability Description
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils/agentFlows/index.js`. Specifically, the combination of `path.join` and `normalizePath` allows attackers to bypass directory restrictions and access or delete arbitrary `.json` files on the server. This can lead to information disclosure, such as leaking sensitive configuration files containing API keys, or denial of service by deleting critical files like `package.json`. The issue is resolved in version 1.12.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
路径遍历：’..filename’
Source: NVD (National Vulnerability Database)
Vulnerability Title
anything-llm 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 1.9.1及之前版本存在安全漏洞，该漏洞源于AgentFlows组件对用户输入处理不当，可能导致路径遍历攻击，进而引发信息泄露或拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified ~ 1.12.1 | - |
II. Public POCs for CVE-2026-5627
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5627
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: mintplex-labs/anything-llm
- CVE-2024-8196
Missing Authentication for Critical Function in mintplex-lab - CVE-2024-8248
Path Traversal in mintplex-labs/anything-llm - CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything- - CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm - CVE-2024-8249
Unauthenticated Denial of Service (DoS) in mintplex-labs/any
Same vendor: mintplex-labs
- CVE-2026-42456
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (ID - CVE-2026-41318
AnythingLLM vulnerable to stored DOM XSS in chart caption re - CVE-2026-32719
AnythingLLM has a Zip Slip Path Traversal and Code Execution - CVE-2026-32717
AnythingLLM access control bypass: suspended users can conti - CVE-2026-32715
AnythingLLM Manager Privilege Bypass Allows Access to Admin-
Same weakness: CWE-29
- CVE-2025-15036
Path Traversal Vulnerability in mlflow/mlflow - CVE-2026-30828
Wallos: SSRF via url parameter leading to File Traversal - CVE-2025-66608
Yokogawa FAST/TOOLS 安全漏洞 - CVE-2024-2356
Remote Code Execution due to LFI in '/reinstall_extension' i - CVE-2025-12790
Rubygem-mqtt: rubygem-mqtt hostname validation
V. Comments for CVE-2026-5627
No comments yet