CVE-2026-5627
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the component.
Published Apr 7, 2026 · updated Jun 17, 2026 · mintplexlabs anythingllm
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the component. The vulnerability arises from improper handling of user input in the and methods in . Specifically, the combination of and allows attackers to bypass directory restrictions and access or delete arbitrary files on the server. This can lead to information disclosure, such as leaking sensitive configuration files containing API keys, or denial of service by deleting critical files like . The issue is resolved in version 1.12.1.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 7, 2026 · NIST NVD
Detected
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the component. The vulnerability arises from improper handling of user input in the and methods in . Specifically, the combination of and allows attackers to bypass directory restrictions and access or delete arbitrary files on the server. This can lead to information disclosure, such as
Jun 17, 2026 · NIST NVD
Updated
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the component. The vulnerability arises from improper handling of user input in the and methods in . Specifically, the combination of and allows attackers to bypass directory restrictions and access or delete arbitrary files on the server. This can lead to information disclosure, such as
Affected
- cpe mintplexlabs/anythingllmversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-5627
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-5627
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the component. The vulnerability arises from improper handling of user input in the and methods in `server/utils/agentFlows/index.js
nvd.nist.gov