CVE-2026-32719: 
Homebrew vulnerability analysis and mitigation

CVE-2026-32719 is a Zip Slip path traversal vulnerability in AnythingLLM that can lead to arbitrary code execution via the community hub plugin import feature. The ImportedPlugin.importCommunityItemFromUrl() function in server/utils/agents/imported.js downloads a ZIP file from a community hub URL and extracts it using AdmZip.extractAllTo() without validating file paths within the archive. It affects AnythingLLM versions 1.11.1 and earlier (Docker package). The vulnerability was published on March 13, 2026, with a patch committed on the same date. The CVSS v3.1 base score is 6.4 (High) per NVD, though the official GitHub advisory rates it 4.2 (Medium) (GitHub Advisory).

The root cause is improper path validation during ZIP archive extraction (CWE-22: Path Traversal), which can chain into code injection (CWE-94) due to AnythingLLM's agent plugin execution model. The vulnerable code calls zip.extractAllTo(pluginFolder) without first iterating entries to check for path traversal sequences such as ../../. A malicious ZIP archive submitted to or served from the community hub can contain entries with paths like ../../server/utils/agents/aibitat/plugins/malicious/handler.js, causing files to be written outside the intended plugin directory. Because agent skill plugins are dynamically loaded and executed by the agent system, a maliciously placed plugin file will subsequently execute with the server process's privileges. Additionally, the download URL is fetched without SSRF validation, accepting both HTTP and HTTPS (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the server process, enabling remote code execution with the server's privileges. The primary impact is high integrity loss through arbitrary file write, which can be escalated to full code execution by overwriting or injecting malicious agent plugins that are subsequently loaded by the AnythingLLM agent system. In multi-user deployments, this could compromise the entire server environment, potentially exposing sensitive data, LLM configurations, API keys, and enabling lateral movement within the hosting infrastructure (GitHub Advisory).

Exploitation requires an attacker to have admin-level privileges within AnythingLLM and to induce the admin to explicitly download a malicious plugin from the community hub (or from a compromised hub server), making the attack complexity high and requiring user interaction. No confirmed proof-of-concept exploit code or in-the-wild exploitation has been observed; the GitHub Security Advisory describes the vulnerability conceptually without providing reproduction steps or a malicious payload (GitHub Advisory). The EPSS score is approximately 0.038%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog.

1. Prepare malicious ZIP: Craft a ZIP archive containing a file with a path traversal entry name, e.g., ../../server/utils/agents/aibitat/plugins/malicious/handler.js, embedding malicious JavaScript code that will execute with server privileges when loaded as an agent plugin.
2. Host or inject the malicious ZIP: Either compromise the AnythingLLM community hub server to serve the malicious ZIP, or submit a malicious community plugin entry that references the attacker-controlled ZIP URL.
3. Social engineer the admin: Convince an AnythingLLM administrator (the only user with hub access in multi-user mode) to navigate to the community hub, enable unverified hub downloads, and import the malicious plugin entry.
4. Trigger extraction: When the admin initiates the import, importCommunityItemFromUrl() downloads the ZIP and calls AdmZip.extractAllTo(pluginFolder) without path validation, causing the traversal payload to write the malicious file outside the plugin directory.
5. Achieve code execution: The next time the AnythingLLM agent system loads plugins, the malicious handler.js is executed with the server process's privileges, enabling reverse shell, data exfiltration, or further persistence (GitHub Advisory, Patch Commit).

• File System: Unexpected .js files appearing outside the intended plugin directory (e.g., in server/utils/agents/aibitat/plugins/ or other server directories) with recent modification timestamps; presence of files with names not matching legitimate community plugins.
• Logs: Server-side error logs referencing ImportedPlugin.importCommunityItemFromUrl or AdmZip extraction; Node.js process logs showing unexpected module loads from non-standard plugin paths.
• Network: Outbound HTTP/HTTPS requests from the AnythingLLM server to unfamiliar or external URLs during plugin import operations; unexpected outbound connections (reverse shell) originating from the Node.js server process after a plugin import event.
• Process: Unusual child processes spawned by the AnythingLLM Node.js process (e.g., sh, bash, curl, wget) following a community hub plugin import action (GitHub Advisory).

Upgrade AnythingLLM to version 1.11.2 or later, which includes the patch commit 6a492f038da195a5c9a239d5ca2e9f2151c25f8c that validates all ZIP entries using zip.getEntries() before extraction, rejecting any entry whose resolved path falls outside the intended plugin folder (Patch Commit). As a workaround prior to patching, restrict or disable the community hub plugin import functionality and limit admin account access to trusted personnel only. Additionally, consider implementing SSRF protections on download URLs and sandboxing imported plugin execution to reduce the blast radius of any future plugin-related vulnerabilities (GitHub Advisory).

The vulnerability was published by timothycarambat (a Mintplex-Labs maintainer) via a GitHub Security Advisory on March 13, 2026, with a same-day patch. A brief write-up was noted on Infinit Security's blog highlighting the Zip Slip and code execution chain. Social media activity was limited, with a Bluesky post from a CVE tracking account referencing the advisory. No major media coverage or significant community debate has been observed, consistent with the high-privilege preconditions limiting the practical attack surface (GitHub Advisory).