CVE-2026-32719

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The ImportedPlugin.importCommunityItemFromUrl() function in server/utils/agents/imported.js downloads a ZIP file from a community hub URL and extracts it using AdmZip.extractAllTo() without validating file paths within the archive. This enables a Zip Slip path traversal attack that can lead to arbitrary code execution.

• CWE-22
• CWE-94

• https://github.com/Mintplex-Labs/anything-llm/commit/6a492f038da195a5c9a239d5ca2e9f2151c25f8cPatch
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rh66-4w74-cf4mExploit, Mitigation, Vendor Advisory

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32713PX4 autopilot is a flight control solution for drones. Prior…6.5
• CVE-2026-32714SciTokens is a reference library for generating and using Sc…9.8
• CVE-2026-32715AnythingLLM is an application that turns pieces of content i…3.8
• CVE-2026-32716SciTokens is a reference library for generating and using Sc…6.5
• CVE-2026-32717AnythingLLM is an application that turns pieces of content i…2.7
• CVE-2026-32718Coolify is an open-source and self-hostable tool for managin…6.5
• CVE-2026-3272A vulnerability was determined in Tenda F453 1.0.0.3. Affect…8.8
• CVE-2026-32720The CTFer.io Monitoring component is in charge of the collec…7.1
• CVE-2026-32721LuCI is the OpenWrt Configuration Interface. Versions prior …4.8
• CVE-2026-32722Memray is a memory profiler for Python. Prior to Memray 1.19…6.1
• CVE-2026-32723SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…4.7
• CVE-2026-32724PX4 autopilot is a flight control solution for drones. Prior…5.3