PatchTheCVECVE-2026-45403: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
CVE-2026-45403 is a low-severity flaw (CVSS 2.0) affecting anythingllm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the AnythingLLM agent filesystem copy tool validates only the top-level source and destination paths. The recursive copy helper then descends into child entries using fs.stat() and copies files with fs.copyFile() without validating each child or rejecting symlinks. Because both APIs follow symlinks, a symlin
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 2.0 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 91%) |
| CISA exploited list | No |
| Weakness | CWE-59 |
| Published | 2026-05-28 |
| Last modified | 2026-07-21 |
Last updated 2026-07-21 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-45403?
anythingllm: upgrade to 1.13.0. Exact commands for each OS are on this page.
Is CVE-2026-45403 being exploited?
CVE-2026-45403 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-45403 affect?
CVE-2026-45403 affects anythingllm. Severity is low (CVSS 2.0). AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the AnythingLLM agent filesystem copy tool validates only the top-level source and destination path
How urgent is CVE-2026-45403?
Priority 14/100. Public exploit reference
Related CVEs
- CVE-2026-5627 HIGH 7.2 UPGRADE A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within
- CVE-2026-41318 MEDIUM 5.4 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
- CVE-2026-42456 MEDIUM 4.3 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
- CVE-2026-48116 HIGH 7.5 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur
- CVE-2026-47713 LOW 2.0 UPGRADE AnythingLLM is an application that turns pieces of content into context that any LLM can use as references dur