CVE-2026-24478

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24478", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T00:38:20.547Z", "datePublished": "2026-01-26T23:23:54.923Z", "dateUpdated": "2026-01-27T21:29:55.195Z"}, "containers": {"cna": {"title": "AnythingLLM vulnerable to Path Traversal", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jp2f-99h9-7vjv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jp2f-99h9-7vjv"}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"version": "< 1.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T23:23:54.923Z"}, "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker who can convince an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE) by overwriting configuration files or writing executable scripts. Version 1.10.0 fixes the issue."}], "source": {"advisory": "GHSA-jp2f-99h9-7vjv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T21:29:29.972528Z", "id": "CVE-2026-24478", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:29:55.195Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24478", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T21:29:29.972528Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:29:51.675Z"}}], "cna": {"title": "AnythingLLM vulnerable to Path Traversal", "source": {"advisory": "GHSA-jp2f-99h9-7vjv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"status": "affected", "version": "< 1.10.0"}]}], "references": [{"url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jp2f-99h9-7vjv", "name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jp2f-99h9-7vjv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker who can convince an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE) by overwriting configuration files or writing executable scripts. Version 1.10.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T23:23:54.923Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24478", "state": "PUBLISHED", "dateUpdated": "2026-01-27T21:29:55.195Z", "dateReserved": "2026-01-23T00:38:20.547Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-26T23:23:54.923Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "anything-llm", "vendor": "Mintplex-Labs", "versions": [{"status": "affected", "version": "< 1.10.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DEA04F2-1EE6-4943-B989-76CB56A33BC2", "versionEndExcluding": "1.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker who can convince an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE) by overwriting configuration files or writing executable scripts. Version 1.10.0 fixes the issue."}, {"lang": "es", "value": "AnythingLLM es una aplicaci\u00f3n que convierte piezas de contenido en contexto que cualquier LLM puede usar como referencias durante el chat. Antes de la versi\u00f3n 1.10.0, una vulnerabilidad cr\u00edtica de salto de ruta en la integraci\u00f3n de DrupalWiki permite a un administrador malicioso (o un atacante que pueda convencer a un administrador para que configure una URL maliciosa de DrupalWiki) escribir archivos arbitrarios en el servidor. Esto puede conducir a la ejecuci\u00f3n remota de c\u00f3digo (RCE) sobrescribiendo archivos de configuraci\u00f3n o escribiendo scripts ejecutables. La versi\u00f3n 1.10.0 soluciona el problema."}], "id": "CVE-2026-24478", "lastModified": "2026-06-17T10:23:07.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24478", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T21:29:29.972528Z", "version": "2.0.3"}}]}, "published": "2026-01-27T00:15:51.297", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jp2f-99h9-7vjv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:33:47.625657+00:00", "value": {"mitigation_remediation": ["Upgrade AnythingLLM to version 1.10.0 or later to eliminate the path traversal flaw.", "If an upgrade is not immediately possible, disable or remove the DrupalWiki integration and enforce strict input validation or allowlist for external URLs.", "Restrict configuration changes to trusted administrators and monitor for unauthorized changes to external service settings."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects all instances of Mintplex\u2011Labs AnythingLLM running versions prior to 1.10.0. Only the product \"AnythingLLM\" from the vendor Mintplex\u2011Labs is impacted, and the vulnerability is limited to the DrupalWiki plug\u2011in component used by those releases.", "description_and_impact": "AnythingLLM contains a path traversal flaw in its DrupalWiki integration that enables an authenticated administrator, or any actor who can persuade an administrator to configure a malicious DrupalWiki URL, to write arbitrary files to the server. By overwriting configuration files or adding executable scripts, an attacker can gain remote code execution capabilities. The weakness aligns with the standard CWE-22 category of path traversal vulnerabilities.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed exploitation in the wild. Exploitation requires administrative privileges or the ability to manipulate an administrator\u2019s configuration settings. If achieved, the attack can lead to full system compromise. Due to the limited exploitation window and requirement for privileged access, the overall risk remains high but opportunistic."}}}}, "created": "2026-01-27T09:03:25.760961+00:00", "updated": "2026-04-18T02:45:27.276664+00:00", "vendors": ["mintplexlabs", "mintplexlabs$PRODUCT$anything-llm"]}