CVE-2026-48789
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
The AnythingLLM application prior to version 1.13.0 on Windows allowed the use of an encoded absolute path to the documents folder, potentially leading to access to files outside the intended documents directory.
Risk Assessment
Exploitation of this vulnerability could allow attackers to access sensitive data within the file system, posing a serious security threat to the organization.
Recommendation
It is recommended to update the AnythingLLM application to version 1.13.0 or later to mitigate this vulnerability.
Original NVD description (English source)
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the document folder listing route can accept an encoded absolute Windows path that resolves outside the intended documents directory. The shared path containment helper rejects POSIX-style "../" traversal but does not reject Windows-style parent paths returned by path.relative(), such as "..". This vulnerability is fixed in 1.13.0.