AnythingLLM Data-Export Path Traversal DoS Request

How the attack works

An attacker (or an automated tool) sends an HTTP request to AnythingLLM's data-export download endpoint. Instead of a normal filename, the request includes traversal or self-reference tokens such as '..', encoded variants like '%2e%2e' or '%252e', a bare dot, an empty segment, encoded slashes, or a null byte. In vulnerable versions (before commit 08d33cfd8), the server joins this untrusted value directly into a file path and then deletes whatever it resolves to after serving it, with no bounds checking. A crafted value that resolves to the current directory or another unintended path triggers an uncontrolled recursive delete, which crashes the Node.js process running AnythingLLM.

Netzilo detection

Why it matters

A single unauthenticated request can crash the AnythingLLM server, causing a denial of service, and the underlying delete operation may also destroy files outside the intended export folder. This rule only detects the malicious request signature; it cannot confirm from network telemetry whether the crash or deletion actually occurred.

What you can do

• →Upgrade AnythingLLM to a version that includes commit 08d33cfd8 or later, which fixes the export path handling.
• →Restrict or authenticate access to the /api/system/data-exports/ endpoint so it cannot be reached anonymously from the internet.
• →Add input validation or a web application firewall rule to reject filenames containing '..', encoded traversal sequences, null bytes, or path separators.
• →Monitor for repeated requests to this endpoint with unusual filename segments, and treat matches as a signal to check server availability and file integrity rather than a confirmed breach.

Known benign look-alikes

• Authorised security testing — a red teamer or the agent itself validating the 08d33cfd8 patch by curling /api/system/data-exports/.. against a lab instance.
• Agent-driven vulnerability scanners (nuclei, ZAP, Burp, custom templates) whose check for this issue replays the exact traversal path against every host.
• Automated patch-verification or CI smoke tests that assert the endpoint now returns 400/403 for a traversal filename.
• A future AnythingLLM release that supports nested export folders and legitimately percent-encodes a separator (%2F) inside the filename parameter.
• Client SDKs or docs tooling that emit a partially substituted route; the filter_template_* selections suppress the common {filename}/:filename forms.

References

• https://github.com/Mintplex-Labs/anything-llm/commit/08d33cfd8
• https://owasp.org/Top10/A03_2021-Injection/
• https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
• https://attack.mitre.org/techniques/T1499/004/