CVE-2026-58499 is a path traversal vulnerability (CWE-22) in EverMind-AI's EverOS memory runtime for agents. The vulnerability exists in versions before 1.0.1 in the POST /api/v1/memory/add ingestion endpoint, where the sender_id field is used as owner_id and incorporated into filesystem paths without proper validation. This allows an unauthenticated attacker to craft sender_id values containing directory traversal sequences (../) to write or overwrite Markdown files outside the configured memory root directory. The vulnerability does not affect confidentiality or availability but allows integrity impact by modifying files with attacker-controlled content. The issue is resolved in EverOS version 1.0.1.

An unauthenticated attacker can exploit this vulnerability to write or overwrite Markdown files at arbitrary locations writable by the server process. This can lead to partial integrity compromise of the filesystem by injecting attacker-influenced content. There is no direct confidentiality or availability impact reported. The vulnerability has a CVSS 3.1 score of 8.2 (high severity) reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

Upgrade EverOS to version 1.0.1 or later, where the path traversal vulnerability in the sender_id field is fixed by proper validation. No other mitigation is indicated or required.