CVE-2026-47118: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in 3clyp50 agent-zero
Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying crafted paths to the image file serving endpoint, which relies solely on an extension allowlist while the path containment check is explicitly disabled. Attackers can request any file with an image extension readable by the process, including files outside the agent workspace, user home directories, and mounted volumes, and can also leverage symlink-based escapes due to the lack of path canonicalization in the path resolution logic.
AI Analysis
Technical Summary
CVE-2026-47118 is a path traversal vulnerability in 3clyp50's Agent Zero before version 1.15. The vulnerability occurs because the image file serving endpoint disables path containment checks and relies solely on an extension allowlist. This allows unauthenticated attackers to supply crafted paths to read arbitrary files accessible by the process, including files outside the agent workspace, user home directories, and mounted volumes. Additionally, the lack of path canonicalization enables attackers to use symlink-based escapes to bypass intended directory restrictions.
Potential Impact
An unauthenticated attacker can read arbitrary files on the system with image extensions accessible by the Agent Zero process. This can lead to exposure of sensitive information stored outside the intended directory scope, including user home directories and mounted volumes. The vulnerability does not require privileges or user interaction and has a high impact on confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Agent Zero service to trusted users and networks to reduce exposure. Monitor for updates from 3clyp50 regarding an official fix or mitigation.
CVE-2026-47118: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in 3clyp50 agent-zero
Description
Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying crafted paths to the image file serving endpoint, which relies solely on an extension allowlist while the path containment check is explicitly disabled. Attackers can request any file with an image extension readable by the process, including files outside the agent workspace, user home directories, and mounted volumes, and can also leverage symlink-based escapes due to the lack of path canonicalization in the path resolution logic.
CVSS v4.0
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47118 is a path traversal vulnerability in 3clyp50's Agent Zero before version 1.15. The vulnerability occurs because the image file serving endpoint disables path containment checks and relies solely on an extension allowlist. This allows unauthenticated attackers to supply crafted paths to read arbitrary files accessible by the process, including files outside the agent workspace, user home directories, and mounted volumes. Additionally, the lack of path canonicalization enables attackers to use symlink-based escapes to bypass intended directory restrictions.
Potential Impact
An unauthenticated attacker can read arbitrary files on the system with image extensions accessible by the Agent Zero process. This can lead to exposure of sensitive information stored outside the intended directory scope, including user home directories and mounted volumes. The vulnerability does not require privileges or user interaction and has a high impact on confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Agent Zero service to trusted users and networks to reduce exposure. Monitor for updates from 3clyp50 regarding an official fix or mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-18T19:22:26.749Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a170b58e29bf47b50c90714
Added to database: 05/27/2026, 15:18:48 UTC
Last enriched: 07/15/2026, 10:04:31 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.