CVE-2026-32719: medium-severity vulnerability in Mintplex-Labs anything-llm
AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.2epss 0.5%
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The ImportedPlugin.importCommunityItemFromUrl() function in server/utils/agents/imported.js downloads a ZIP file from a community hub URL and extracts it using AdmZip.extractAllTo() without validating file paths within the archive. This enables a Zip Slip path traversal attack that can lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
Affected products
Mintplex-Labs · anything-llmRelated CVEs — Mintplex-Labs anything-llm
In the same product, most dangerous first.
CVE-2026-24477HIGHAnythingLLM has key leak in `systemSettings.js`EPSS 2.1%CVE-2024-22422HIGHUnauthenticated Denial of Service (DOS) attack in AnythingLLMEPSS 1.0%CVE-2026-24478HIGHAnythingLLM vulnerable to Path TraversalEPSS 0.9%CVE-2026-32626CRITICALAnythingLLM has a Streaming Phase XSS to RCE via LLM Response InjectionEPSS 0.8%CVE-2026-21484MEDIUMAnythingLLM Vulnerable to Username Enumeration w/ Password RecoveryEPSS 0.8%CVE-2026-32617HIGHAnythingLLM Permissable CORS policyEPSS 0.5%