# AnythingLLM Data-Export Path Traversal DoS Request

- **Severity:** High
- **Signature ID:** `7b3c1f8e-2d54-4a61-9c0f-5e8a4d3b6127`

## Summary

AnythingLLM's file-export feature can be crashed with a single unauthenticated web request. By sending a crafted filename containing path traversal characters, an attacker can make the server delete files outside the intended folder and crash, taking the AI service offline.

## How the attack works

An attacker (or an automated tool) sends an HTTP request to AnythingLLM's data-export download endpoint. Instead of a normal filename, the request includes traversal or self-reference tokens such as '..', encoded variants like '%2e%2e' or '%252e', a bare dot, an empty segment, encoded slashes, or a null byte. In vulnerable versions (before commit 08d33cfd8), the server joins this untrusted value directly into a file path and then deletes whatever it resolves to after serving it, with no bounds checking. A crafted value that resolves to the current directory or another unintended path triggers an uncontrolled recursive delete, which crashes the Node.js process running AnythingLLM.

## Why it matters

A single unauthenticated request can crash the AnythingLLM server, causing a denial of service, and the underlying delete operation may also destroy files outside the intended export folder. This rule only detects the malicious request signature; it cannot confirm from network telemetry whether the crash or deletion actually occurred.

## What you can do

- Upgrade AnythingLLM to a version that includes commit 08d33cfd8 or later, which fixes the export path handling.
- Restrict or authenticate access to the /api/system/data-exports/ endpoint so it cannot be reached anonymously from the internet.
- Add input validation or a web application firewall rule to reject filenames containing '..', encoded traversal sequences, null bytes, or path separators.
- Monitor for repeated requests to this endpoint with unusual filename segments, and treat matches as a signal to check server availability and file integrity rather than a confirmed breach.

## Known benign look-alikes

- Authorised security testing — a red teamer or the agent itself validating the 08d33cfd8 patch by curling /api/system/data-exports/.. against a lab instance.
- Agent-driven vulnerability scanners (nuclei, ZAP, Burp, custom templates) whose check for this issue replays the exact traversal path against every host.
- Automated patch-verification or CI smoke tests that assert the endpoint now returns 400/403 for a traversal filename.
- A future AnythingLLM release that supports nested export folders and legitimately percent-encodes a separator (%2F) inside the filename parameter.
- Client SDKs or docs tooling that emit a partially substituted route; the filter_template_* selections suppress the common {filename}/:filename forms.

## References

- https://github.com/Mintplex-Labs/anything-llm/commit/08d33cfd8
- https://owasp.org/Top10/A03_2021-Injection/
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
- https://attack.mitre.org/techniques/T1499/004/

---
Source: https://www.netzilo.com/threats/anythingllm-export-traversal-dos