CVE-2026-5627
CWE-29Published: April 7, 2026· Updated: Apr 8, 2026
Official Description
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils/agentFlows/index.js`. Specifically, the combination of `path.join` and `normalizePath` allows attackers to bypass directory restrictions and access or delete arbitrary `.json` files on the server. This can lead to information disclosure, such as leaking sensitive configuration files containing API keys, or denial of service by deleting critical files like `package.json`. The issue is resolved in version 1.12.1.
Risk Analysis
This critical path traversal vulnerability in mintplex-labs/anything-llm allows authenticated attackers to access or delete arbitrary JSON files on the server. Improper handling of user input in agent flow methods can lead to information disclosure, such as API keys, or denial of service by deleting critical files. The CVSS score of 9.1 indicates a high severity risk, especially for authenticated users.
No public exploit is currently known for this vulnerability. It is remotely exploitable by an authenticated user.
Upgrade mintplex-labs/anything-llm to version 1.12.1 or later. Implement strict input validation and sanitization for file paths to prevent directory traversal.
Technical Analysis
CVE-2026-5627 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.1.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-29)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-5627 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts