CVE-2026-5627

OVERVIEW CVE-2026-5627 is a path traversal vulnerability affecting Mintplex Labs' Anything-LLM application through version 1.9.1. The vulnerability exists in the AgentFlows component, specifically within the loadFlow and deleteFlow methods in server/utils/agentFlows/index.js. Improper input validation allows attackers to bypass directory restrictions and access or delete arbitrary JSON files on the affected system. SEVERITY This vulnerability carries a CVSS 3.0 score of 9.1 (Critical) with a network-based attack vector requiring high privileges but no user interaction. The flaw enables attackers to achieve confidentiality, integrity, and availability impacts across multiple systems. Potential consequences include information disclosure of sensitive configuration files containing API keys and denial of service through deletion of critical application files such as package.json. The EPSS score of 0.00044 indicates relatively low prevalence in the wild compared to other known vulnerabilities. EXPLOITATION STATUS There is no current evidence of active exploitation, as the vulnerability is not included in the Known Exploited Vulnerabilities catalog. The FAUCET Risk Score of 53.0/100 suggests moderate concern from a research perspective. No public exploit code availability has been reported. The vulnerability was remediated in version 1.12.1, and organizations should prioritize upgrading from affected versions to address this critical path traversal flaw.