Langroid's file tools (ReadFileTool and WriteFileTool) assume that changing the process working directory to a configured curr_dir is sufficient to restrict file operations. However, they do not resolve or enforce that the user-supplied file_path remains within curr_dir. This allows an attacker or user controlling the tool arguments to supply path traversal sequences (e.g., '../secret.txt') to read or write files outside the intended directory. A proof-of-concept demonstrated successful reading and writing of files outside the sandbox directory. The vulnerability is relevant when Langroid file tools are exposed in workflows where an LLM agent or user can influence file paths, potentially exposing or modifying sensitive files adjacent to the project directory.

An attacker or user controlling tool inputs can read arbitrary files outside the intended workspace or project directory, potentially exposing secrets, configuration files, or source code. They can also write files outside the sandbox, potentially modifying files outside the intended boundary. The impact depends on how the application exposes these tools and whether curr_dir is relied upon to restrict file access. There is no indication of unauthenticated remote exploitation by default. The vulnerability affects confidentiality and integrity but not availability.

No official patch or fix is currently confirmed. Users should implement path validation by resolving both the base directory (curr_dir) and the target file path, then reject any file paths that escape the base directory before performing read or write operations. This can be done by comparing resolved absolute paths and ensuring the target path is within the base directory. Monitor the vendor advisory for official fixes or updates.