CVE-2026-24478: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24478 is a critical Path Traversal vulnerability (CWE-22) in the DrupalWiki integration of AnythingLLM, an open-source LLM application platform developed by Mintplex Labs. The flaw allows a malicious admin — or an attacker who can convince an admin to configure a malicious DrupalWiki URL — to write arbitrary files to the server, potentially leading to Remote Code Execution (RCE). All AnythingLLM versions prior to 1.10.0 are affected. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Red Hat CVE). The vulnerability was published on January 27, 2026, and patched in version 1.10.0 released shortly after (GitHub Advisory).

The root cause is improper input sanitization in collector/utils/extensions/DrupalWiki/DrupalWiki/index.js, specifically in the _downloadAndProcessAttachments method. The fileName field is extracted directly from an external API response without any validation or sanitization, then concatenated with WATCH_DIRECTORY to form a file path that is passed to fs.writeFileSync(). An attacker controlling the DrupalWiki server can return a fileName value such as ../../../../../tmp/pwn.txt, causing the application to write attacker-controlled content outside the intended directory (CWE-22). The attack vector is network-based, requires high privileges (admin access), and no user interaction beyond the initial configuration step (GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location writable by the AnythingLLM process, resulting in high confidentiality, integrity, and availability impact. The most severe consequence is Remote Code Execution (RCE), achievable by overwriting application configuration files (e.g., .env), writing to cron directories, or injecting executable scripts into init paths. Additionally, overwriting critical system files can cause Denial of Service. The attack scope is limited to the server hosting AnythingLLM, but a full server compromise could enable lateral movement within the hosting environment (GitHub Advisory).

A proof-of-concept (PoC) exploit script (drupalwiki_file_write_exploit.py) is publicly available in the GitHub security advisory, along with a mock malicious DrupalWiki server implementation in Python. The PoC demonstrates bypassing the UI by directly communicating with the collector using signed headers. There is no current evidence of in-the-wild exploitation. The EPSS score is 0.00147 (approximately 0.15%), indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Set up a malicious DrupalWiki server: Run a Python HTTP server that mimics the DrupalWiki REST API. Configure the /api/rest/scope/api/attachment endpoint to return a JSON response with a malicious fileName value such as ../../../../../tmp/pwn.txt and a corresponding download endpoint that serves attacker-controlled content.
2. Gain or abuse admin access: Log in to the AnythingLLM instance as an admin, or socially engineer an admin into configuring the DrupalWiki integration to point to the attacker-controlled server (e.g., http://attacker.com:12346).
3. Trigger the DrupalWiki sync: Initiate a sync of the DrupalWiki integration via the UI or by sending a crafted POST request to the collector endpoint (/ext/drupalwiki) with appropriate signed headers (X-Payload-Signer, X-Integrity) as demonstrated in the public PoC.
4. Achieve arbitrary file write: The _downloadAndProcessAttachments method fetches the attachment metadata, extracts the unsanitized fileName, and writes the downloaded content to ${WATCH_DIRECTORY}/../../../../../tmp/pwn.txt, effectively writing to /tmp/pwn.txt or any other target path.
5. Escalate to RCE: Write a malicious script to a cron directory, overwrite an application startup script, or modify the .env configuration file to inject commands that execute upon the next application restart or scheduled task run (GitHub Advisory).

• Network: Outbound HTTP GET requests from the AnythingLLM collector to an unexpected or external host on non-standard ports (e.g., port 12346); requests to paths matching /api/rest/scope/api/page, /api/rest/scope/api/attachment, or /api/rest/scope/api/attachment/*/download targeting an unrecognized DrupalWiki server.
• File System: Unexpected files created outside the WATCH_DIRECTORY path, particularly in /tmp/, cron directories (/etc/cron.d/, /etc/cron.daily/), or application root directories; modification timestamps on .env or configuration files inconsistent with normal operations.
• Logs: AnythingLLM collector logs showing DrupalWiki sync activity pointing to an unfamiliar base URL; fs.writeFileSync operations to paths containing ../ sequences in application debug logs.
• Process: Unexpected processes spawned by the AnythingLLM Node.js process (e.g., shell commands, reverse shells); new cron jobs or scheduled tasks created under the service account running AnythingLLM (GitHub Advisory).

The primary remediation is to upgrade AnythingLLM to version 1.10.0 or later, which fixes the path traversal by sanitizing the fileName field before constructing file paths (GitHub Advisory). As interim mitigations, restrict admin access to trusted users only and implement strict controls over which DrupalWiki URLs can be configured. Monitor the server filesystem for unauthorized file modifications, particularly outside the designated WATCH_DIRECTORY. If the DrupalWiki integration is not in use, disable or remove it to reduce attack surface.

The vulnerability was reported by security researcher YLChen-007 and published by Mintplex Labs maintainer timothycarambat via GitHub's security advisory system. The advisory was picked up by several vulnerability tracking platforms including INCIBE-CERT, CCN-CERT, VulnDB, and CVEFeed shortly after disclosure. A Bluesky post from a CVE tracking account noted the vulnerability, and the security blog Infinitsec published a dedicated write-up (Infinitsec Blog). No major vendor statements beyond the official advisory or significant social media controversy have been observed.