CVE-2026-29870

A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run. The save_to_file method in ace/skillbook.py fails to normalize or validate filesystem paths, allowing traversal sequences to escape the intended checkpoint directory. This vulnerability allows attackers to overwrite arbitrary files accessible to the application process, potentially leading to application corruption, privilege escalation, or code execution depending on the deployment context.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29870.md

Configurations

No configuration.

History

No history.

Information

Published : 2026-03-31 15:16

Updated : 2026-07-25 10:10

NVD link : CVE-2026-29870

Mitre link : CVE-2026-29870

CVE.ORG link : CVE-2026-29870

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-29870", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29870", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T15:06:38.268919Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-31T15:16:12.733", "references": [{"url": "https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29870.md", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run. The save_to_file method in ace/skillbook.py fails to normalize or validate filesystem paths, allowing traversal sequences to escape the intended checkpoint directory. This vulnerability allows attackers to overwrite arbitrary files accessible to the application process, potentially leading to application corruption, privilege escalation, or code execution depending on the deployment context."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio en el proyecto agentic-context-engine versiones hasta la 0.7.1 permite escrituras de archivos arbitrarias a trav\u00e9s del par\u00e1metro checkpoint_dir en OfflineACE.run. El m\u00e9todo save_to_file en ace/skillbook.py no normaliza ni valida las rutas del sistema de archivos, permitiendo que las secuencias de salto escapen del directorio de punto de control previsto. Esta vulnerabilidad permite a los atacantes sobrescribir archivos arbitrarios accesibles al proceso de la aplicaci\u00f3n, lo que podr\u00eda llevar a la corrupci\u00f3n de la aplicaci\u00f3n, escalada de privilegios, o ejecuci\u00f3n de c\u00f3digo dependiendo del contexto de despliegue."}], "lastModified": "2026-07-25T10:10:00.167", "sourceIdentifier": "cve@mitre.org"}