CVE-2026-91989: dep0we atomic-agents-stack, обхождане на път

Описание

Оригинално описание

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.

Засегнати продукти

• dep0we atomic-agents-stack: преди 1.1.0; 1.1.0

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в dep0we atomic-agents-stack

• 9.2CVE-2026-91988
• 7.1CVE-2026-91987

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-91989
• https://nvd.nist.gov/vuln/detail/CVE-2026-91989
• https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj
• https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-path-traversal-via-dashboard-serve-py