The atomic-agents-stack dashboard HTTP server has a path traversal vulnerability in its file serving component. It constructs filesystem paths directly from HTTP request paths without proper containment checks, allowing attackers to read arbitrary files outside the intended directory. By default, the server binds to loopback, but it can be configured to bind to all interfaces, exposing the vulnerability to the LAN. This flaw affects all versions prior to 1.1.0. A fix is available that enforces safe path resolution and restricts host binding.