PT-2026-25398 · Admzip+1 · Adm-Zip+1

Timothycarambat · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-32719

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:H/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). The ImportedPlugin.importCommunityItemFromUrl() function, located in server/utils/agents/imported.js, downloads ZIP files from community hub URLs and extracts their contents using AdmZip.extractAllTo(). A lack of validation for file paths within the archive allows for a Zip Slip path traversal attack, potentially leading to arbitrary code execution.

Recommendations Versions prior to 1.11.1 should be updated. As a temporary workaround, consider restricting the use of the importCommunityItemFromUrl() function until a patch is available.

Exploit

Fix

Code Injection

Path traversal

Weakness Enumeration

CWE-94

CWE-22

Related Identifiers

BDU:2026-04254

CVE-2026-32719

GHSA-RH66-4W74-CF4M

Affected Products

Adm-Zip

Anything-Llm

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32719.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/6a492f038da195a5c9a239d5ca2e9f2151c25f8c · Patch
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rh66-4w74-cf4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32719 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32719 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04254 · Security Note
• https://twitter.com/CVEnew/status/2032605818072281412 · Twitter Post
• https://t.me/CVEtracker/47392 · Telegram Post