VulnerabilityAnalyzed

CVE-2026-32719

This enables a Zip Slip path traversal attack that can lead to arbitrary code execution.

MEDIUM 6.4EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The ImportedPlugin.importCommunityItemFromUrl() function in server/utils/agents/imported.js downloads a ZIP file from a community hub URL and extracts it using AdmZip.extractAllTo() without validating file paths within the archive. This enables a Zip Slip path traversal attack that can lead to arbitrary code execution.

CVSS 3.1: 6.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.39% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-94
Affected: mintplexlabs/anythingllm
Source: security-advisories@github.com

References

https://github.com/Mintplex-Labs/anything-llm/commit/6a492f038da195a5c9a239d5ca2e9f2151c25f8cPatch
https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rh66-4w74-cf4mExploit, Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.