PT-2026-30828 · Mintplexlabs+1 · Anything-Llm+1

Published 2026-04-07 · Updated 2026-04-13 · CVE-2026-5627

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.12.1

Description A path traversal issue exists within the AgentFlows component due to improper handling of user input in the loadFlow() and deleteFlow() functions located in 'server/utils/agentFlows/index.js'. The use of path.join and normalizePath allows attackers to bypass directory restrictions to access or delete arbitrary .json files on the server. This can result in information disclosure, such as leaking sensitive configuration files containing API keys, or a denial of service by deleting critical files like package.json.

Recommendations Update to version 1.12.1.

Exploit

Fix

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2026-5627

Affected Products

Anything-Llm

Mintplex-Labs/Anything-Llm

References · 5

• 🔥 https://huntr.com/bounties/597d41c5-7ea0-4786-80f4-bd536ec66374 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/3444b9b0aa6764d72d53670ab4b1aaccdc6b7017 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5627 · Security Note
• https://twitter.com/CVEnew/status/2043733110555386183 · Twitter Post
• https://twitter.com/infoflowcloud/status/2043733979577135128 · Twitter Post