agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.
References
Configurations
No configuration.
History
07 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://gist.github.com/Ro1ME/13af0869833757245685d2d390458664 - | |
| References | () https://github.com/agent0ai/agent-zero/issues/1540 - |
30 Sep 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-30 21:17
Updated : 2026-10-07 16:17
NVD link : CVE-2026-51852
Mitre link : CVE-2026-51852
CVE.ORG link : CVE-2026-51852
JSON object : View
Products Affected
No product.
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')