CVE-2026-108543: Path Traversal in ag2ai ag2

This vulnerability in ag2ai ag2 (versions 0.13.0 through 0.13.4) involves improper handling of the filename argument in the UserProxyAgent component's os.path.join function, enabling remote attackers to perform path traversal attacks. Such attacks can allow unauthorized access to files outside the intended directory. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. The vendor has not issued a fix or response as of the publication date.

Successful exploitation of this vulnerability can allow an attacker to access or manipulate files outside the intended directory structure on the affected system, potentially leading to unauthorized information disclosure or modification. The CVSS score of 5.3 indicates a medium severity impact with low complexity and no required privileges beyond limited privileges.

No official patch or remediation has been provided by the vendor as of the publication date. Users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected component or implementing network-level controls to limit exposure. Review and harden file system permissions to minimize potential impact.