CVE-2026-48789: AnythingLLM Windows Path Traversal – Information Disclosure Vulnerability

Technical summary

The vulnerability exists in the document folder listing route of AnythingLLM on Windows. The application implements path containment validation using a helper function designed to reject POSIX-style directory traversal attempts ("../"), but it fails to properly reject Windows-style parent directory references returned by path.relative(). This allows an authenticated attacker to submit an encoded absolute Windows path that resolves outside the intended documents directory. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is mitigated in version 1.13.0.

Business impact

This vulnerability enables information disclosure to authenticated users. An attacker with valid AnythingLLM credentials could enumerate and read directory listings from any location on an affected Windows server, potentially exposing sensitive documents, configuration files, or other confidential information stored on the system. Since exploitation requires authentication, the risk is limited to insider threats or compromised user accounts rather than unauthenticated external attacks. Organizations using AnythingLLM on Windows to manage sensitive documents should prioritize updating to prevent unauthorized information exposure.

Affected systems

AnythingLLM versions prior to 1.13.0 running on Windows systems are affected. The vulnerability is specific to Windows path handling; Linux and macOS systems are not impacted due to differences in path resolution behavior. Any deployment using an older version on Windows infrastructure requires patching.

Exploitability

Exploitability is moderate. The attack requires valid AnythingLLM user credentials (authentication is a prerequisite), but no user interaction is needed once authenticated. The attack involves crafting an encoded Windows path and submitting it to the document listing API. Network accessibility to the application is required. An attacker with stolen or compromised credentials can execute this attack without special tools or deep technical knowledge.

Remediation

Upgrade AnythingLLM to version 1.13.0 or later. Verify the patch version against the official AnythingLLM release notes. If immediate patching is not possible, restrict network access to AnythingLLM to trusted users and networks, implement strong access controls for user credentials, and monitor API logs for suspicious path-based queries to the document listing endpoint.

Patch guidance

Apply the official update to AnythingLLM 1.13.0 as released by the vendor. Review the official AnythingLLM release notes and security advisories for detailed patching instructions and any compatibility considerations. Test the upgrade in a non-production environment before deploying to production systems. Confirm the patched version is running by checking the application version string after update.

Detection guidance

Monitor AnythingLLM API logs for document listing requests containing encoded paths or unusual path patterns, particularly those with encoded characters (%2e%2e) or paths that include absolute Windows paths (C:\, D:\, etc.). Review access logs for authenticated users accessing the document listing endpoint with suspicious parameters. Implement network segmentation to restrict AnythingLLM access to authorized personnel only. Use endpoint detection and response (EDR) tools to monitor process behavior and file system access from the AnythingLLM application process.

Why prioritize this

While the CVSS score is medium (4.3) and the vulnerability requires authentication, it represents a clear information disclosure risk in a content management context. Organizations storing sensitive documents or using AnythingLLM in regulated environments should prioritize patching to prevent potential compliance violations or unauthorized exposure of confidential information. The fix is straightforward (version upgrade), making remediation efficient.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects low attack complexity, network accessibility, and a low privilege requirement (authenticated users), offset by limited confidentiality impact and no integrity or availability impact. The score appropriately weighs the requirement for prior authentication, which reduces the severity compared to unauthenticated path traversal vulnerabilities, while acknowledging the direct information disclosure risk.

Frequently asked questions