CVE-2026-108599 in phi
Summary
by MITRE • 10/10/2026
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The phi library, specifically versions ranging from 0.1.1 through 0.28.4, suffers from a critical improper link resolution vulnerability that undermines security boundaries designed to restrict file system access within isolated environments. This flaw is rooted in the permission gate mechanism which relies exclusively on lexical path checks rather than resolving symbolic links or canonical paths before validating write permissions. By exploiting this deficiency, malicious repositories can craft symlinks that point outside the designated workspace directory, effectively bypassing the workspace_only_writes configuration setting intended to contain file operations within a specific sandboxed area.
The technical core of this vulnerability lies in the failure to normalize file system paths prior to permission evaluation. When the application processes a request to write content, it checks if the target path resides within the allowed workspace based on string comparison or simple prefix matching. However, because symbolic links are not resolved into their actual physical locations during this check, an attacker can create a symlink inside the permitted directory that points to a sensitive file located in the parent directory or elsewhere on the system. The permission gate sees only the safe-looking path within the workspace and grants write access, unaware that the underlying operation will affect files outside the intended scope.
This technical flaw enables significant operational impact by allowing unauthorized modification of external files without user approval. Attackers can leverage this capability in conjunction with prompt injection techniques to manipulate the AI agent into writing malicious content or exfiltrating sensitive data to locations beyond the workspace boundary. This breaks the isolation guarantees provided by the sandbox, potentially leading to system compromise, data leakage, or further exploitation through modified configuration files or scripts located outside the controlled environment. The ability to write arbitrary content to external paths without explicit approval represents a severe breach of integrity and confidentiality controls.
From an industry standards perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. It also relates to CWE-829: Inclusion of Functionality from Untrusted Control Sphere, as the system fails to properly validate the trustworthiness and location of resources being accessed. Additionally, this behavior facilitates techniques described in MITRE ATT&CK under T1053: Scheduled Task/Job or T1608: Stage Capabilities, where an attacker establishes persistence or prepares for further execution by modifying files outside the monitored workspace area.
To mitigate this vulnerability, it is essential to update phi to a version that resolves symbolic links and canonicalizes paths before performing permission checks. Implementing strict path normalization using operating system-level functions ensures that relative references are resolved to their absolute physical locations prior to validation against allowed directories. Furthermore, developers should enforce chroot jails or containerized environments with immutable file systems where possible to limit the impact of any potential bypasses. Regular security audits focusing on file I/O operations and permission gate logic will help identify similar weaknesses in other components that handle user-supplied paths.