AnythingLLM is a content‑to‑LLM context engine. A vulnerability exists in the filesystem copy tool that validates only the top‑level source and destination paths, then recursively copies child entries without re‑validating or rejecting symlinks. Because the APIs follow symlinks, a malicious symlink that resides inside an allowed source directory can point to a file outside the permitted filesystem root, enabling the application to copy arbitrary external files into an allowed destination. This flaw can lead to unintended exposure of files that were intended to be protected, affecting confidentiality of data that resides outside the user’s permitted namespace.

Mintplex‑Labs AnythingLLM versions prior to 1.13.0 are vulnerable. All installations that rely on the default filesystem copy helper and have not applied the 1.13.0 fix are exposed. Updated releases starting at 1.13.0 include a fix to validate each child entry and reject symlinks.

The CVSS score of 2 indicates a low severity risk under normal conditions; however, the vulnerability can lead to malicious file disclosure, which may be valuable to an attacker if sensitive data resides outside the allowed directory. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited documented exploitation at this time. The likely attack vector is local, requiring access to the application’s file system or influence over the source directory structure. An attacker can create a nested symlink within an allowed source path that points to an external file, then trigger the copy operation to transfer that file into the allowed destination.