CVE-2026-51853

Directory traversal in Agent‑Zero (1.7‑1.10) lets any agent read any system file.

• CWE-22 (inferred)
• Input Validation and Sanitization
• Remote

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.

CVE

CVE-2026-51853

CWE

CWE-22 (inferred)

Published

2026-09-30

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade agent-zero to version 1.11 or later, which fixes the Directory Traversal issue in FileBrowser.__init__.

import os

class FileBrowser:
    def __init__(self, root_path):
        # VULNERABLE: uses provided path as workspace without validation
        self.root = root_path
        self.current = root_path

    def list_dir(self, sub_path=""):
        target = os.path.join(self.current, sub_path)
        return os.listdir(target)

    def read_file(self, file_path):
        target = os.path.join(self.current, file_path)
        with open(target, "r") as f:
            return f.read()

import os

class FileBrowser:
    def __init__(self, root_path):
        # FIX: resolve and confine to a safe base directory
        base = os.path.abspath(root_path)
        self.root = base
        self.current = base

    def list_dir(self, sub_path=""):
        target = os.path.abspath(os.path.join(self.current, sub_path))
        if not target.startswith(self.root + os.sep):
            raise PermissionError("Path traversal detected")
        return os.listdir(target)

    def read_file(self, file_path):
        target = os.path.abspath(os.path.join(self.current, file_path))
        if not target.startswith(self.root + os.sep):
            raise PermissionError("Path traversal detected")
        with open(target, "r") as f:
            return f.read()

@misc{vaitp:cve202651853,
  title        = {{Directory traversal in Agent‑Zero (1.7‑1.10) lets any agent read any system file.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-51853},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-51853/}}
}