CVE-2026-58499 is a path traversal vulnerability (CWE-22) in EverMind-AI's EverOS memory runtime for agents. In versions before 1.0.1, the POST /api/v1/memory/add ingestion endpoint improperly handles the sender_id field by not validating it as a path-safe identifier. Since sender_id is used as owner_id and incorporated into the filesystem path for storing extracted episodes as Markdown files, an attacker can craft a sender_id containing '../' sequences to write files outside the designated memory root directory. This allows an unauthenticated attacker to create or overwrite .md files at arbitrary writable locations on the server with partially attacker-controlled content. The vulnerability has a CVSS 3.1 score of 8.2, indicating high severity. The issue is resolved in EverOS version 1.0.1.

An unauthenticated attacker can exploit this vulnerability to perform path traversal and write or overwrite Markdown files outside the intended directory. This can lead to partial attacker-controlled content being written to arbitrary writable locations on the server, potentially impacting system integrity. There is no direct confidentiality impact reported. Availability impact is low. No known exploits in the wild have been reported.

Upgrade EverOS to version 1.0.1 or later, where this path traversal vulnerability is fixed. Patch status is confirmed by the vendor stating the issue is resolved in 1.0.1. Until upgrading, restrict access to the POST /api/v1/memory/add endpoint if possible to reduce exposure.