The vulnerability exists in the atomic-agents-stack dashboard HTTP server (dashboard/serve.py), specifically in the DashboardHandler.do_GET and _serve_file methods. The server builds filesystem paths from the request path without routing through the safe path resolution function (_io.safe_resolve_under), allowing literal '../' segments to survive URL parsing and path joining. This enables arbitrary file read outside the intended agents_root directory. The default server bind is loopback, but the --host flag can be set by operators to bind to 0.0.0.0, exposing the vulnerability to the local network. Even on loopback, DNS rebinding or SSRF can be used to exploit the flaw. The vulnerability affects all versions before 1.1.0. The recommended fix is to route all served paths through _io.safe_resolve_under and reject path traversal attempts early, and optionally restrict non-loopback binding unless explicitly authorized.

An attacker can read arbitrary files on the server filesystem outside the intended directory, potentially exposing sensitive information. The vulnerability is exploitable remotely if the server is bound to a non-loopback interface or via DNS rebinding or SSRF attacks even when bound to loopback. This can lead to information disclosure without requiring authentication or user interaction.

A patch is available that routes all served paths through the safe path resolution function (_io.safe_resolve_under) and rejects requests with path traversal attempts. Operators should upgrade to version 1.1.0 or later. Additionally, restricting the server to bind only to loopback interfaces by default and requiring explicit authorization for non-loopback binding reduces exposure. Rejecting '..' and separator characters early in request paths further mitigates the risk.