What the vulnerability does
01Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker who can convince an admin to configure a malicious DrupalWiki URL) to write arbitrary files to the server. This can lead to Remote Code Execution (RCE) by overwriting configuration files or writing executable scripts. Version 1.10.0 fixes the issue.
Explanation of Vulnerability in Simple Terms
02Summary
Anything LLM versions before 1.10.0 contain a path traversal vulnerability that allows authenticated administrators to read and write arbitrary files on the server. An attacker with admin credentials can bypass file access restrictions and access sensitive data or modify system files. This requires high-level privileges and network access to the application.
What an attacker can do
03Attacker Capabilities
Read and write arbitrary files on the server filesystem.
Potential impact on your site
04Site Impact
An admin account compromise could lead to full server file system access, data theft, or malicious file modifications.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level credentials and network access to the application.
Key dates
06Disclosure timeline
January 26, 2026
CVE published
January 27, 2026
Record updated
