CVE-2026-5627
Mintplexlabs Anythingllm ≤ 1.9.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-5627 is a high-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Mintplexlabs Anythingllm. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-5627 is a path traversal vulnerability in mintplex-labs/anything-llm versions up to and including 1.9.1. It affects the AgentFlows component, specifically the loadFlow and deleteFlow methods in server/utils/agentFlows/index.js. The issue stems from improper handling of user input, where the combination of path.join and normalizePath enables attackers to bypass directory restrictions and access or delete arbitrary .json files on the server.
Attackers require high privileges (PR:H) and network access to exploit this vulnerability, which has low complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows reading sensitive files, such as configuration files containing API keys, leading to information disclosure, or deleting critical files like package.json, resulting in denial of service. The CVSS v3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), with associated CWE-29.
The vulnerability is resolved in anything-llm version 1.12.1. Security practitioners should upgrade to this version for mitigation. The fixing commit is available at https://github.com/mintplex-labs/anything-llm/commit/3444b9b0aa6764d72d53670ab4b1aaccdc6b7017, and further details are in the Huntr bounty report at https://huntr.com/bounties/597d41c5-7ea0-4786-80f4-bd536ec66374.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19637
Vulnerability Data
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils/agentFlows/index.js`. Specifically, the combination of `path.join` and…
more
`normalizePath` allows attackers to bypass directory restrictions and access or delete arbitrary `.json` files on the server. This can lead to information disclosure, such as leaking sensitive configuration files containing API keys, or denial of service by deleting critical files like `package.json`. The issue is resolved in version 1.12.1.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: llm
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly neutralizes the '\..\filename' sequence before pathname resolution occurs.
Access enforcement denies requests that resolve outside the intended directory even when the traversal sequence is present.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that block this traversal vector.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover path-traversal flaws but does not itself prevent them in production code.
Application security requirements can mandate input validation and path canonicalization to block traversal sequences.
Secure architecture principles include directory sandboxing and safe file-access design that mitigate path traversal.
Secure coding standards directly require neutralizing path traversal sequences such as '\..\filename'.