AnythingLLM contains a path traversal flaw in its DrupalWiki integration that enables an authenticated administrator, or any actor who can persuade an administrator to configure a malicious DrupalWiki URL, to write arbitrary files to the server. By overwriting configuration files or adding executable scripts, an attacker can gain remote code execution capabilities. The weakness aligns with the standard CWE-22 category of path traversal vulnerabilities.

The issue affects all instances of Mintplex‑Labs AnythingLLM running versions prior to 1.10.0. Only the product "AnythingLLM" from the vendor Mintplex‑Labs is impacted, and the vulnerability is limited to the DrupalWiki plug‑in component used by those releases.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed exploitation in the wild. Exploitation requires administrative privileges or the ability to manipulate an administrator’s configuration settings. If achieved, the attack can lead to full system compromise. Due to the limited exploitation window and requirement for privileged access, the overall risk remains high but opportunistic.