CVE-2026-48789: 
MinimOS 脆弱性の分析と軽減

CVE-2026-48789 is a Windows path traversal vulnerability in AnythingLLM (by Mintplex-Labs) that allows authenticated users with a valid API key to list JSON document metadata from folders outside the intended documents root directory. The flaw affects all versions prior to 1.13.0 and is specific to Windows deployments. It was published on June 24, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The affected route is GET /v1/documents/folder/:folderName, where the shared path containment helper correctly rejects POSIX-style ../ traversal sequences but fails to reject Windows-style parent path segments (e.g., ..) returned by Node.js's path.relative(). An attacker can supply an encoded absolute Windows path as the folderName parameter, causing the server to resolve a path outside the intended documents directory and return its contents. Exploitation requires a valid API key (low-privilege authenticated access) and a Windows-based deployment (GitHub Advisory).

Successful exploitation allows a low-privileged authenticated attacker to enumerate and read JSON document metadata from arbitrary folders on the Windows host filesystem outside the intended documents root. This is a confidentiality-only impact — there is no integrity or availability impact. Sensitive application data or configuration metadata stored in sibling directories could be exposed, potentially aiding further attacks (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.0023 (0.23%), indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the technical impact as "partial." The CVE status is listed as "Deferred" and it is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain API Key: Acquire a valid AnythingLLM API key through legitimate access, credential theft, or other means — low-privilege access is sufficient.
2. Identify Windows Deployment: Confirm the target AnythingLLM instance is running on Windows, as the vulnerability is OS-specific.
3. Craft Malicious Request: Send a GET request to the vulnerable endpoint GET /v1/documents/folder/:folderName, supplying a URL-encoded absolute Windows path (e.g., C%3A%5CUsers%5C...) or a Windows-style relative path using .. segments that resolve outside the documents root.
4. Bypass Path Containment: The server's path containment helper fails to reject the Windows-style .. traversal returned by path.relative(), allowing the path to resolve outside the intended directory.
5. Enumerate Files: Observe the HTTP 200 response containing JSON document metadata from the targeted folder outside the documents root, potentially revealing sensitive file names or application data (GitHub Advisory).

• Network: Unusual GET requests to /v1/documents/folder/ with URL-encoded absolute Windows paths (e.g., containing %3A, %5C, or %2E%2E) or .. segments in the folder name parameter.
• Logs: AnythingLLM access logs showing HTTP 200 responses to /v1/documents/folder/ requests with path values that do not correspond to valid document folder names; repeated requests with varying encoded path values from the same API key.
• Application Behavior: Requests resolving to directories outside the configured documents root returning successful responses rather than HTTP 404 errors.

Upgrade AnythingLLM to version 1.13.0 or later, which fixes the vulnerability by updating the path containment helper to reject both ../ and .. relative paths, as well as absolute results from path.relative(). The fix is also available in commit 0002d229d6d3e8bd3829f1ae7590d96c44379e89. No official workaround is provided for users unable to upgrade immediately; restricting API key issuance to trusted users and limiting network access to the AnythingLLM instance can reduce exposure in the interim (GitHub Advisory).