Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils/agentFlows/index.js`. Specifically, the combination of `path.join` and `normalizePath` allows attackers to bypass directory restrictions and access or delete arbitrary `.json` files on the server. This can lead to information disclosure, such as leaking sensitive configuration files containing API keys, or denial of service by deleting critical files like `package.json`. The issue is resolved in version 1.12.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-07 | 2 | Disclosure1Patch1 |
| 2026-04-13 | 2 | Disclosure2 |
CVE-2026-5627 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from… https://www.cve.org/CVERecord?id=CVE-2026-5627
Post summary
The message discloses a path traversal vulnerability in mintplex-labs/anything-llm versions up to 1.9.1, referencing the CVE record for additional details.
🚨*CVE* CVE-2026-5627 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from… https://www.cve.org/CVERecord?id=CVE-2026-5627 ----- Traducción: CVE-2026-5627 Exi… http://infoflow.cloud`
Post summary
The post announces CVE-2026-5627 as a path traversal flaw in mintplex-labs/anything-llm up to v1.9.1, offering technical details but lacking any claim of exploitation or patch information.
[CVE-2026-5627: CRITICAL] Path traversal vulnerability in mintplex-labs/anything-llm up to v1.9.1 lets attackers access/delete files. Patch in v1.12.1 fixes the issue. #CyberSecurity#cve,CVE-2026-5627,#cybersecurity https://cvefind.com/CVE-2026-5627
Post summary
The post discloses a critical path traversal vulnerability in mintplex-labs/anything‑llm (up to v1.9.1), explains it allows file access/deletion, and announces that the issue is resolved in v1.12.1.
🚨 CVE-2026-5627: Pat... LLM platforms with path traversal = API key goldmine; `path.join` + `normalizePath` bypass screams amateur hour security #PathTraversal #LLM #APIKeys. https://zerodaysignal.com/vulnerability/CVE-2026-5627 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE‑2026‑5627, identifying it as a path traversal flaw in LLM platforms that could expose API keys, but it lacks details on PoC code, active exploitation, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mintplexlabs | anythingllm | - | - | - |