CVE-2026-45403: AnythingLLM Path Traversal via Symlink Abuse – Patch to 1.13.0

Technical summary

The vulnerability stems from incomplete path validation in AnythingLLM's recursive copy functionality. The agent filesystem copy tool validates only the top-level source and destination paths before initiating a copy operation. However, when the recursive copy helper processes child entries, it calls fs.stat() and fs.copyFile() without validating each nested path or rejecting symbolic links. Both Node.js filesystem APIs automatically follow symlinks, meaning a malicious symlink placed within an allowed source directory can point to arbitrary filesystem locations outside the root. When copied, the symlink target's contents become accessible as regular files in the allowed destination directory. This bypasses the intended filesystem isolation. The issue is resolved in version 1.13.0 by adding per-entry validation and symlink rejection during recursive traversal.

Business impact

For organizations using AnythingLLM in production, this vulnerability presents a limited but real risk to data confidentiality. An internal actor with administrative access could potentially exfiltrate sensitive files stored on the same system—such as configuration files, credentials, or private documents—by crafting malicious symlinks and triggering copy operations. The risk is primarily internal; remote attackers cannot exploit this without first gaining high-level system access. Organizations relying on AnythingLLM for handling proprietary or regulated data should prioritize upgrading to mitigate the risk of accidental or intentional insider abuse.

Affected systems

AnythingLLM prior to version 1.13.0 is affected. This includes all deployments of the application running earlier versions, whether self-hosted, containerized, or integrated into third-party systems. The Mintplex Labs project should be checked for the availability of version 1.13.0 or later patches across supported deployment methods (Docker, npm, cloud instances, or direct installation).

Exploitability

Exploitation is restricted by multiple factors. The attacker must possess high-level user privileges within AnythingLLM to access the agent filesystem copy tool, the application must be configured to allow filesystem operations, the attacker must be able to create or have pre-existing symlinks within the source directory structure, and user interaction is required to trigger the copy operation. These constraints significantly limit the attack surface. No known public exploits or automated weaponization exist (not on CISA KEV list). Exploitation is most realistic in scenarios involving disgruntled insiders or compromised high-privilege accounts already operating within a trusted network.

Remediation

Upgrade to AnythingLLM version 1.13.0 or later. Verify the upgrade through your deployment method (Docker image update, npm package update, or direct binary replacement depending on your installation). After upgrade, restart the service and verify core functionality. No configuration changes or data migration is required. For organizations unable to upgrade immediately, restrict access to the agent filesystem copy tool to trusted administrators only and monitor filesystem copy operations for suspicious activity.

Patch guidance

To patch your installation: (1) For Docker deployments, pull and redeploy the image tagged 1.13.0 or later from the Mintplex Labs registry. (2) For npm-based installations, run `npm install anythingllm@latest` or explicitly update to 1.13.0+. (3) For direct installations, download the 1.13.0 release binary from the official Mintplex Labs releases page. After any deployment method, restart the service and confirm it initializes without errors. Test the filesystem copy functionality with legitimate paths to ensure the fix does not break normal operations. Verify against the vendor advisory at the Mintplex Labs GitHub repository for any additional migration guidance.

Detection guidance

Monitor logs for recursive filesystem copy operations targeting unexpected paths or those exiting the intended source directory. Watch for fs.stat() or fs.copyFile() calls that reference symbolic links, especially within user-controlled or agent-managed directories. Endpoint detection and response (EDR) solutions should flag processes spawned by AnythingLLM that access files outside expected application directories. File integrity monitoring on sensitive configuration and credential files can detect unauthorized copying. Review access controls on the system running AnythingLLM to identify unnecessary high-privilege accounts that could exploit this vulnerability. Check for recently created symlinks within AnythingLLM's working directories that may indicate pre-positioning for attacks.

Why prioritize this

Although this vulnerability carries a low CVSS score (2.0) due to high privilege requirements, user interaction, and limited scope, it directly threatens data confidentiality for organizations handling sensitive information. Prioritize based on your deployment context: (1) High priority if AnythingLLM manages proprietary, regulated, or confidential data and multiple administrators have access. (2) Medium priority for standard deployments with restricted admin access and regular security monitoring. (3) Lower priority for isolated development or non-production instances. The fix is straightforward and incurs no operational risk, making patching cost-effective even for lower-risk environments.

Risk score, explained

The CVSS 3.1 score of 2.0 (LOW severity, vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) reflects the combination of factors: network-accessible vector (AV:N) offset by high attack complexity due to symlink setup requirements (AC:H), high privilege level (PR:H) and required user interaction (UI:R). The impact is limited to confidentiality (C:L) with no integrity or availability impact. However, the score underweights the practical risk in environments where multiple privileged users have unsupervised access or where insider threats are a concern. Treat the score as a technical baseline rather than a complete business risk assessment.

Frequently asked questions