AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical …

CVE-2026-24478 is a critical Path Traversal vulnerability in AnythingLLM's DrupalWiki integration prior to version 1.10.0. The vulnerability allows a malicious admin or attacker to write arbitrary files to the server through a malicious DrupalWiki URL configuration. This can lead to Remote Code Execution by overwriting configuration files or writing executable scripts. The issue affects the application's ability to turn content into context for LLM references during chatting. Version 1.10.0 contains the fix for this vulnerability.