CVE-2026-48789CWE-22

AnythingLLM: Windows path containment bypass in document folder route

Medium · published June 24, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the document folder listing route can accept an encoded absolute Windows path that resolves outside the intended documents directory. The shared path containment helper rejects POSIX-style "../" traversal but does not reject Windows-style parent paths returned by path.relative(), such as "..". This vulnerability is fixed in 1.13.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-24T17:13Z
EPSS history
Timeline
  • 24 JUN 17:13Z
    AnythingLLM: Windows path containment bypass in document folder route
    cvelistv5