| Title | Tencent AI-Infra-Guard v4.5.1 Improper Input Validation |
|---|
| Description | A vulnerability was found in Tencent AI-Infra-Guard v4.5.1 (skill scanner version 0.3.1). Affected are the agent file access tools read_file in skill_scan/tools/dir/dir_actions.py line 58, grep_file in grep_actions.py line 36, and write_file in write_file.py line 23.
AI-Infra-Guard =============================================================================is an agentic scanner: it exposes file access tools to an LLM agent and relies on the agent to explore an untrusted "skill" directory. Those three tools confine the agent to the skill directory using a string prefix comparison of the form:
if not abs_path.startswith(self.base_dir):
return "Access denied"
A string prefix test is not equivalent to path containment. Where the base directory is /tmp/scan/skill, the path /tmp/scan/skill-evil/secrets.txt satisfies the prefix test and is admitted, because the string "/tmp/scan/skill-evil" begins with "/tmp/scan/skill". The agent can therefore read, grep, or write files in sibling directories whose names share the base directory name as a prefix.
The vendor's own source establishes that path containment is the intended design and that the correct primitive was already known to the developers. read_file.py line 67 and ls_actions.py line 30 implement the same confinement using os.path.commonpath():
os.path.commonpath([abs_path, self.base_dir]) == self.base_dir
Three of the five file access tools use the unsafe prefix test and two use the correct containment check, so this is an inconsistently applied existing control rather than a missing feature.
Proof of concept: a prompt-injected SKILL.md instructing the agent to read ../skill-evil/secrets.txt to verify configuration. The agent resolves the path, the prefix test returns true because the sibling directory name begins with the base directory name, and access is granted. The comparison can be confirmed statically:
base = "/tmp/scan/skill"
path = "/tmp/scan/skill-evil/secrets.txt"
os.path.abspath(path).startswith(base) -> True (bypassed)
os.path.commonpath([os.path.abspath(path), base]) == base -> False (blocked)
Reachability is deliberately stated conservatively here. Because os.path.abspath() normalises the path, ordinary parent-directory traversal such as ../../etc/passwd resolves to a path that fails the prefix test and is correctly blocked. Exploitation requires a sibling directory whose name shares the base directory name as a prefix and which the attacker controls or can predict. The realistic scenario is batch or marketplace scanning in which per-skill directories are derived from skill names, allowing one submitted skill to reach another submitted skill's files, or any deployment where the scan root is predictable.
The impact is a confinement bypass in the agent's file access sandbox, permitting read, grep and write outside the intended scan directory within that constraint.
The weakness is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
The exploit is publicly available. The vendor has not responded and the issue is unfixed as of 2026-08-15. A suitable remediation is to replace the prefix test in dir_actions.py, grep_actions.py and write_file.py with the os.path.commonpath() check already used in read_file.py and ls_actions.py.
Suggested scoring: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.1, Medium).
|
|---|
| Source | ⚠️ https://github.com/Tencent/AI-Infra-Guard/issues/538 |
|---|
| User | nedlir (UID 95981) |
|---|
| Submission | 08/15/2026 13:23 (1 month ago) |
|---|
| Moderation | 09/27/2026 20:14 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410952 [Tencent AI-Infra-Guard up to 4.5.2/4.6.2 File Access dir_actions.py startsWith path traversal] |
|---|
| Points | 20 |
|---|