CVE-2026-48789 Overview
AnythingLLM is an application that converts content into context for large language models (LLMs) to reference during chat interactions. A path traversal vulnerability (CWE-22) affects AnythingLLM versions prior to 1.13.0 on Windows. The document folder listing route accepts an encoded absolute Windows path that resolves outside the intended documents directory. The shared path containment helper rejects POSIX-style ../ traversal but fails to reject Windows-style parent paths returned by path.relative(), such as ... The issue is fixed in version 1.13.0.
Critical Impact
Authenticated remote attackers can enumerate directory contents outside the intended documents directory on Windows hosts running AnythingLLM.
Affected Products
- AnythingLLM versions prior to 1.13.0
- Deployments running on Windows operating systems
- Self-hosted and containerized Windows-based AnythingLLM instances
Discovery Timeline
- 2026-06-24 - CVE-2026-48789 published to the National Vulnerability Database (NVD)
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-48789
Vulnerability Analysis
The vulnerability resides in the document folder listing route within AnythingLLM. The route accepts a folder parameter that is intended to be constrained to the application's documents directory. On Windows hosts, attackers can supply an encoded absolute Windows path that resolves outside that directory. The application returns directory listing data from the unintended location.
The flaw is exploitable over the network by an authenticated user with low privileges. Successful exploitation breaks confidentiality by exposing file and folder names outside the documents scope. It does not directly affect integrity or availability.
Root Cause
The shared path containment helper performs validation against POSIX-style traversal sequences. It rejects inputs containing ../ segments. The helper does not account for the output of Node.js path.relative() on Windows, which can return .. style results when comparing absolute Windows paths across drives or directories. As a result, encoded absolute Windows paths bypass the containment check and resolve to arbitrary locations on the host file system.
Attack Vector
An authenticated attacker submits a crafted request to the document folder listing endpoint. The folder parameter contains a URL-encoded absolute Windows path, for example referencing a different directory or drive letter. The containment helper evaluates the relative path between the documents root and the requested target, receives a Windows-style parent reference that does not match its POSIX traversal pattern, and accepts the input. The route then enumerates the unintended directory. See the GitHub Security Advisory GHSA-j4m9-wwcq-m868 for technical details.
Detection Methods for CVE-2026-48789
Indicators of Compromise
- Requests to the AnythingLLM document folder listing route containing URL-encoded absolute Windows paths such as C%3A%5C or drive-letter prefixes
- Application logs showing folder listings returned for paths outside the configured documents directory
- Repeated authenticated requests probing different drive letters or system directories
Detection Strategies
- Inspect web server and application logs for folder listing requests whose decoded parameters contain absolute paths or backslash sequences
- Compare requested folder targets against the configured documents root and alert on mismatches
- Correlate authenticated user sessions with anomalous enumeration patterns across multiple folder paths
Monitoring Recommendations
- Enable verbose request logging on the AnythingLLM API and forward logs to a centralized SIEM
- Monitor file system access on Windows hosts for AnythingLLM process reads outside the documents directory
- Track authenticated user activity volumes for accounts issuing high-rate folder listing requests
How to Mitigate CVE-2026-48789
Immediate Actions Required
- Upgrade AnythingLLM to version 1.13.0 or later on all Windows deployments
- Audit existing user accounts and revoke unnecessary authenticated access until patching is complete
- Review application logs for prior exploitation attempts targeting the folder listing endpoint
Patch Information
The vulnerability is fixed in AnythingLLM 1.13.0. The fix updates the shared path containment helper to correctly reject Windows-style parent path references returned by path.relative(). Patch details are documented in the GitHub Security Advisory GHSA-j4m9-wwcq-m868.
Workarounds
- Restrict network access to the AnythingLLM instance to trusted users until the upgrade is applied
- Run AnythingLLM under a low-privilege Windows service account with file system access limited to the documents directory
- Place the application behind a reverse proxy that filters request parameters containing absolute Windows paths or encoded drive letters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
