Executive brief
AnythingLLM is an application that converts documents and content into context for AI chatbots. A security flaw in its file management tool allows an attacker with high-level access to trick the system into copying sensitive files from restricted areas of the server into public or accessible folders. This could lead to the unauthorized disclosure of internal system files, though it requires specific conditions and high-level permissions to execute.
Technical details
A symlink traversal vulnerability exists in the AnythingLLM agent filesystem plugin's copy-file tool. The `copyRecursive` helper function uses `fs.stat()` and `fs.copyFile()`, both of which follow symbolic links, but only validates the initial top-level source and destination paths. An attacker with the ability to place a nested symlink within an allowed directory can point that link to a file outside the allowed filesystem root; when the copy tool executes, it materializes the target file as a regular file in the destination directory. This bypasses the plugin's directory boundary protections. The issue is fixed in version 1.13.0 by implementing `fs.lstat()` to detect and reject symbolic links during copy operations.
Affected products
- Mintplex-Labs AnythingLLM < 1.13.0
Timeline
- 2026-05-10: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD
- 2026-05-28: patched: Fix committed in version 1.13.0