CVE-2026-5627 | mintplex-labs anything-llm up to 1.12.0 AgentFlows index.js loadFlow/deleteFlow path traversal

A vulnerability categorized as problematic has been discovered in mintplex-labs anything-llm up to 1.12.0. This affects the function loadFlow/deleteFlow of the file server/utils/agentFlows/index.js of the component AgentFlows. Such manipulation leads to path traversal: ‘..filename’.

This vulnerability is listed as CVE-2026-5627. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.