AnythingLLM vulnerabilities

AnythingLLM before version 1.10.0 has a critical Path Traversal vulnerability in the DrupalWiki integration, allowing a malicious admin (or an attacker who convinces an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE).

AnythingLLM before version 1.10.0, when configured to use Qdrant as the vector database with an API key, can expose this key in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of the key allows an attacker full read/write access to the Qdrant vector database.

AnythingLLM 1.16.1 and earlier allows the manager role to store meta_page_title or meta_page_favicon values via /api/admin/system-preferences, which MetaGenerator inserts into production homepage HTML without escaping. The values pass unchanged through systemSettings.js and reach MetaGenerator.generate() in server/index.js.

In AnythingLLM versions 1.0.0 to 1.15.0, the unauthenticated account-recovery flow has a flaw in recoverAccount() that fails to trim recovery code values before deduplication. An attacker knowing the username and one recovery code can submit the same code twice with different whitespace to satisfy the two-code check and take over an account, including an administrator.

The AnythingLLM application has a vulnerability that allows managers or admins to delete parsed files of other users in any workspace, even if they are not members. The issue arises from a lack of ownership checks during file deletion, enabling attackers to manipulate file IDs.

The AnythingLLM application prior to version 1.13.0 on Windows allowed the use of an encoded absolute path to the documents folder, potentially leading to access to files outside the intended documents directory.

In AnythingLLM prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument starting with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor, running /bin/sh for each file. Attackers can use this with the filesystem-write-text-file skill to execute arbitrary commands in the AnythingLLM server container.

In AnythingLLM prior to version 1.13.0, an approved mobile device token created in single-user mode can survive migration to multi-user mode even when the device record has userId = null. In multi-user mode, this stale token is still accepted by the mobile authentication middleware, allowing enumeration of workspaces and content without per-user filtering.

In AnythingLLM prior to version 1.13.0, the agent filesystem copy tool validates only the top-level source and destination paths. The recursive copy helper does not validate each child entry or reject symlinks, allowing bypass of restrictions and copying files from outside the allowed filesystem root.

An IDOR vulnerability in AnythingLLM before version 1.12.1 allows an authenticated user to access another user's assistant response in audio form. The GET /api/workspace/:slug/tts/:chatId endpoint does not enforce chat ownership, only workspace membership.

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces, including identifiers, AI model configurations, system prompts, operational parameters, and vector search settings.