A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal… (CVE-2026-37007)

The vulnerability in FileWriterTool in crewai-tools (versions up to 1.10.2rc1) allows remote code execution through malicious path traversal in the filename argument. This flaw enables an attacker to manipulate file paths to write or execute unauthorized code remotely. The issue is categorized as CWE-22, indicating improper restriction of file pathnames. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation details are available in the provided data, and no active exploitation has been reported.

Successful exploitation allows a remote attacker to execute arbitrary code on the affected system without authentication or user interaction. This can lead to full system compromise, including unauthorized access, data modification, and service disruption. The critical CVSS score (9.8) reflects the severity of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable component and monitor for suspicious activity related to file path manipulation. Avoid exposing the FileWriterTool interface to untrusted networks or users.