CVE-2026-48116
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In AnythingLLM prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument starting with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor, running /bin/sh for each file. Attackers can use this with the filesystem-write-text-file skill to execute arbitrary commands in the AnythingLLM server container.
Risk Assessment
The risk is remote code execution (RCE) in the AnythingLLM container by an attacker who can chat with an agent with the filesystem plugin enabled (default in the official Docker image). This could lead to full container compromise and data access.
Recommendation
Immediately upgrade AnythingLLM to version 1.13.0 or later. If upgrade is not possible, temporarily disable the filesystem plugin or restrict agent access to trusted users only.
Other vulnerabilities in AnythingLLM
See all- CVE-2026-24478High
AnythingLLM before version 1.10.0 has a critical Path Traversal vulnerability in the DrupalWiki integration, allowing a malicious admin (or an attacker who convinces an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE).
- CVE-2026-24477High
AnythingLLM before version 1.10.0, when configured to use Qdrant as the vector database with an API key, can expose this key in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of the key allows an attacker full read/write access to the Qdrant vector database.
- CVE-2026-72917Medium
In AnythingLLM versions 1.0.0 to 1.15.0, the unauthenticated account-recovery flow has a flaw in recoverAccount() that fails to trim recovery code values before deduplication. An attacker knowing the username and one recovery code can submit the same code twice with different whitespace to satisfy the two-code check and take over an account, including an administrator.
- CVE-2026-55611Unknown
The AnythingLLM application has a vulnerability that allows managers or admins to delete parsed files of other users in any workspace, even if they are not members. The issue arises from a lack of ownership checks during file deletion, enabling attackers to manipulate file IDs.
- CVE-2026-48789Medium
The AnythingLLM application prior to version 1.13.0 on Windows allowed the use of an encoded absolute path to the documents folder, potentially leading to access to files outside the intended documents directory.
- CVE-2026-47713Low
In AnythingLLM prior to version 1.13.0, an approved mobile device token created in single-user mode can survive migration to multi-user mode even when the device record has userId = null. In multi-user mode, this stale token is still accepted by the mobile authentication middleware, allowing enumeration of workspaces and content without per-user filtering.
- CVE-2026-45403Low
In AnythingLLM prior to version 1.13.0, the agent filesystem copy tool validates only the top-level source and destination paths. The recursive copy helper does not validate each child entry or reject symlinks, allowing bypass of restrictions and copying files from outside the allowed filesystem root.
- CVE-2026-42456Medium
An IDOR vulnerability in AnythingLLM before version 1.12.1 allows an authenticated user to access another user's assistant response in audio form. The GET /api/workspace/:slug/tts/:chatId endpoint does not enforce chat ownership, only workspace membership.
Original NVD description (English source)
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument that starts with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor: it runs /bin/sh <file> for every file it walks. An attacker who can chat with an agent on a deployment with the filesystem plugin enabled (the default in the official Docker image) can use this, together with the sibling filesystem-write-text-file skill, to run arbitrary commands inside the AnythingLLM server container. This vulnerability is fixed in 1.13.0.