CVE-2026-55747 in PocketFlow
Summary
by MITRE • 08/05/2026
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a `_path(workdir, p)` helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because os.path.join returns an absolute `p` unchanged (ignoring workdir) and does not resolve '../' sequences, an agent invocation whose file-tool arguments include an absolute path or a traversal sequence can read or write files outside the configured working directory. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability described in the pocketflow-coding-agent cookbook example represents a critical directory traversal flaw that stems from improper path handling within the file access tools. This issue manifests through the `_path(workdir, p)` helper function which serves as a thin wrapper around os.path.join without implementing any canonicalization or containment validation measures. The implementation fails to properly sanitize input paths, creating an environment where absolute paths or traversal sequences can bypass directory restrictions and access files outside the intended working directory scope.
The technical flaw operates through the fundamental behavior of os.path.join which preserves absolute paths unchanged and does not resolve relative path sequences such as '../'. When file access tools like ReadFile, ListFiles, PatchRead, and PatchApply utilize this helper without additional validation, they become vulnerable to path traversal attacks. An attacker can exploit this by providing arguments containing absolute paths or directory traversal sequences that circumvent the intended workdir containment boundaries, effectively granting unauthorized access to arbitrary files on the system.
The operational impact of this vulnerability extends beyond mere code examples to potentially affect production systems that adopt similar patterns from the illustrative cookbook. Applications implementing file operations using this flawed approach can experience unauthorized data access, modification, or deletion across system boundaries. The severity classification reflects that while this primarily impacts a demonstration example rather than core library functionality, the pattern's adoption in real-world applications creates substantial security risks. This vulnerability directly maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and aligns with ATT&CK technique T1059.007 (Command and Scripting Interpreter: PowerShell) where path traversal can enable arbitrary file access through compromised command execution flows.
Mitigation strategies should focus on implementing proper path canonicalization before file operations, ensuring all input paths are resolved to their absolute form and validated against the intended working directory boundaries. The recommended approach involves using os.path.realpath() or similar functions to resolve symbolic links and relative sequences, followed by containment checks that verify resolved paths remain within acceptable directories. Additionally, applications should employ strict input validation for file access operations, rejecting any path components that attempt to traverse beyond configured boundaries. Security-conscious implementations should also consider implementing sandboxing mechanisms or restricted execution environments to further limit potential damage from such vulnerabilities.