CVE-2026-51853 in agent-zero
Summary
by MITRE • 10/01/2026
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Agent Zero versions 1.7 through 1.10 represents a critical security flaw rooted in improper initialization of the file browser component within the python/helpers/file_browser.py module. Specifically, the FileBrowser class constructor accepts or defaults to using the host system's root directory as its workspace base path without implementing adequate input validation or access control mechanisms. This design decision effectively bypasses standard sandboxing principles that are typically expected in autonomous agent architectures, allowing the software to traverse arbitrary directories on the underlying operating system. By initializing with such broad permissions, the application fails to restrict file operations to a designated safe directory, thereby exposing sensitive system files and user data to potential unauthorized access or modification by any entity capable of invoking this class.
From a technical perspective, this flaw aligns directly with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The absence of strict boundary checks means that relative paths containing directory traversal sequences such as dot-dot-slash can be resolved against the root directory rather than a confined workspace. This allows an attacker or malicious agent logic to read files outside the intended scope, including configuration files with embedded credentials, private keys, and other sensitive artifacts stored in system directories like etc, var, or home folders of other users. The vulnerability is particularly severe because it does not require complex exploitation techniques; simply requesting a file path that navigates upward from the workspace root grants unrestricted read access to the entire filesystem hierarchy accessible by the user running the Agent Zero process.
The operational impact of this vulnerability is significant, as it compromises the confidentiality and potentially the integrity of data processed or stored on the host machine. An adversary who can influence the agent's behavior through prompt injection or other means could leverage this flaw to exfiltrate sensitive information, leading to a complete breach of system security. Furthermore, if write permissions are inadvertently granted in subsequent operations not explicitly detailed but implied by the broad workspace definition, there is a risk of modifying critical system files, which could lead to denial of service or further privilege escalation. This aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, where adversaries search for specific data on compromised systems, as well as T1560: Archive Collected Data, if the attacker intends to package sensitive files for exfiltration.
To mitigate this vulnerability, it is imperative that developers update Agent Zero to a patched version where the FileBrowser class enforces strict path canonicalization and restricts all file operations to a predefined, isolated workspace directory. Implementing chroot-like restrictions or using operating system-level sandboxing can further limit the blast radius of any potential exploitation. Additionally, input validation should be applied to ensure that resolved paths remain within the allowed boundaries before any filesystem interaction occurs. Until an official patch is available, users should restrict the execution privileges of Agent Zero to a minimal user account with limited file access rights and avoid processing untrusted prompts or inputs that could trigger arbitrary file system navigation commands.