AnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)
AnythingLLM's document collector accepts a filename in an API request and uses it without checking for directory traversal sequences. An attacker can supply a filename containing '../' to escape the intended upload folder and delete arbitrary files on the server, including AnythingLLM's own database.
How the attack works
An attacker sends a POST request to the collector's /process endpoint with a JSON body containing a 'filename' field. Instead of a normal document name, the filename includes '../' sequences, for example '../../server/storage/anythingllm.db'. The server passes this value directly into its file-processing function without stripping or validating the path, so the traversal sequence takes effect. The resulting operation deletes the targeted file, which can be outside the intended watch directory, including the application's own storage.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- bb4ae21c-505d-488b-a4cd-46b342478d0b
- Severity
- Critical
- CVEs
- CVE-2023-5832
Why it matters
A low-privilege user can delete arbitrary files on the server, including the AnythingLLM database itself, causing data loss or denial of service without needing elevated access.
What you can do
- →Upgrade AnythingLLM to a version at or above 0.1.0 where this issue is fixed.
- →Restrict network or authentication access to the collector API so only trusted internal services can reach /process.
- →Add filename validation or a path-normalization check in front of the collector if you cannot upgrade immediately, rejecting any filename containing '../' or absolute paths.
- →Monitor collector logs for /process requests with filename values containing '../' or targeting known internal storage paths like anythingllm.db.
Known benign look-alikes
- A legitimate POST /process call whose JSON filename is a plain document name inside the hotdir (e.g. {"filename":"report.pdf"}) with no ../ traversal sequence is benign and must not fire.
- Documentation or code that mentions the AnythingLLM collector /process endpoint or the filename field without any ../ directory-traversal payload.
- Generic mentions of anythingllm.db, hotdir, or WATCH_DIRECTORY in setup docs/backups without a traversal sequence reaching them.