What’s Vulnerable › Products
Mintplexlabs Anythingllm vulnerabilities
68 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.
Check whether your Mintplexlabs Anythingllm version is affected
Latest Mintplexlabs Anythingllm vulnerabilities
- CVE-2026-48116 — AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill (CVSS 8.8)
- CVE-2026-47713 — AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration (CVSS 4.3)
- CVE-2026-45403 — AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory (CVSS 2.5)
- CVE-2026-42456 — AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) (CVSS 4.3)
- CVE-2026-41318 — AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component (CVSS 5.4)
- CVE-2026-5627 — Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- CVE-2026-32719 — AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import (CVSS 6.4)
- CVE-2026-32717 — AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys (CVSS 2.7)
- CVE-2026-32715 — AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences (CVSS 3.8)
- CVE-2026-32628 — AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter (CVSS 8.8)
- CVE-2026-32626 — AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection (CVSS 9.6)
- CVE-2026-32617 — AnythingLLM Permissable CORS policy (CVSS 7.5)
- CVE-2026-24478 — AnythingLLM vulnerable to Path Traversal (CVSS 7.2)
- CVE-2026-24477 — AnythingLLM has key leak in `systemSettings.js` (CVSS 7.5)
- CVE-2026-21484 — AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery (CVSS 5.3)
- CVE-2025-63390 — (CVSS 5.3)
- CVE-2024-8251 — Prisma Injection in mintplex-labs/anything-llm (CVSS 5.3)
- CVE-2024-8249 — Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm (CVSS 7.5)
- CVE-2024-8248 — Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- CVE-2024-7771 — Denial of Service in mintplex-labs/anything-llm (CVSS 6.5)
- CVE-2024-6842 — Exposure of Sensitive Information in mintplex-labs/anything-llm (CVSS 7.5)
- CVE-2024-10513 — Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- CVE-2024-10109 — Incorrect Authorization in mintplex-labs/anything-llm (CVSS 8.3)
- CVE-2024-13059 — Path Traversal in mintplex-labs/anything-llm (CVSS 7.2)
- CVE-2024-7783 — Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm (CVSS 7.5)