The vulnerability in zhayujie CowAgent up to version 2.1.0 involves improper validation of the Name argument in the _add_url/_add_package functions of agent/skills/service.py. This allows an attacker to perform a path traversal attack remotely, potentially accessing or modifying files outside the intended directory. The issue is resolved by upgrading to version 2.1.2, which includes a patch identified by commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264.

Successful exploitation of this vulnerability could allow an attacker with network access and low privileges to traverse the file system, potentially leading to unauthorized access or modification of files. The impact is limited by the requirement of low privileges and the absence of user interaction or complex attack vectors. No known exploits in the wild have been reported.

Upgrade zhayujie CowAgent to version 2.1.2 or later to apply the official patch that fixes this path traversal vulnerability. Since this is a cloud service, the vendor manages remediation server-side; verify with the vendor advisory that the service is updated accordingly.