CVE-2026-48789 is a path traversal vulnerability (CWE-22) in Mintplex-Labs' AnythingLLM application affecting versions before 1.13.0 on Windows. The document folder listing route accepts encoded absolute Windows paths that can escape the intended documents directory. The shared path containment helper function fails to reject Windows-style parent directory references returned by path.relative(), allowing traversal outside the restricted directory. This vulnerability allows an attacker with low privileges to read files outside the intended directory. The issue is resolved in version 1.13.0.

An attacker with low privileges can exploit this vulnerability to read files outside the intended documents directory on Windows systems running affected versions of AnythingLLM. The confidentiality of files may be compromised. There is no impact on integrity or availability reported. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and limited impact to confidentiality only.

This vulnerability is fixed in AnythingLLM version 1.13.0. Users should upgrade to version 1.13.0 or later to remediate this issue. No other vendor advisory or patch information is available. Patch status is not yet confirmed by vendor advisory text but the description explicitly states the fix is in 1.13.0.