PT-2026-25398 · Admzip+1 · Adm-Zip+1

Timothycarambat · Publicado 2026-03-13 · Atualizado 2026-03-16 · CVE-2026-32719

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:H/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). The ImportedPlugin.importCommunityItemFromUrl() function, located in server/utils/agents/imported.js, downloads ZIP files from community hub URLs and extracts their contents using AdmZip.extractAllTo(). A lack of validation for file paths within the archive allows for a Zip Slip path traversal attack, potentially leading to arbitrary code execution.

Recommendations Versions prior to 1.11.1 should be updated. As a temporary workaround, consider restricting the use of the importCommunityItemFromUrl() function until a patch is available.

Exploit

Correção

Code Injection

Path traversal

Enumeração de Fraquezas

CWE-94

CWE-22

Identificadores relacionados

BDU:2026-04254

CVE-2026-32719

GHSA-RH66-4W74-CF4M

Produtos afetados

Adm-Zip

Anything-Llm

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32719.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/6a492f038da195a5c9a239d5ca2e9f2151c25f8c · Correção
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rh66-4w74-cf4m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32719 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32719 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-04254 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032605818072281412 · Publicação no Twitter
• https://t.me/CVEtracker/47392 · Publicação no Telegram