提交 #864278: FoundationAgents MetaGPT 1.0.0 Path Traversal

### Description

MetaGPT's file access implementation does not enforce a strict workspace boundary, allowing generated code to read arbitrary host files outside the intended project scope. The `DataInterpreter` component can generate and execute logic that accesses sensitive system files and user configuration files.

The file read path accepts absolute paths without workspace boundary validation:

```python
# metagpt/tools/libs/editor.py:133-150
async def read(self, path: str) -> FileBlock:
path = self._try_fix_path(path)
...
content = await File.read_text_file(path)
```

Path normalization logic:

```python
# metagpt/tools/libs/editor.py:1096-1102
def _try_fix_path(self, path: Union[Path, str]) -> Path:
if not isinstance(path, Path):
path = Path(path)
if not path.is_absolute():
path = self.working_dir / path
return path
```

This implementation:
- Preserves absolute paths without validation
- Does not deny access to sensitive system paths
- Does not enforce that file reads remain inside the workspace root

Validated file access includes:
- `/etc/passwd` (system user information)
- `~/.gitconfig` (Git user identity)
- Credential-adjacent paths (`~/.git-credentials`, `~/.netrc`)

### Root cause

- Entry route:
File access through `DataInterpreter` task execution
- Preconditions:
User runs a task that generates file-reading logic targeting host paths
- Code paths:
`metagpt/tools/libs/editor.py:133-150` (file read)
`metagpt/tools/libs/editor.py:1096-1102` (path normalization)
- Root cause:
Missing workspace boundary enforcement in file access path normalization
- Impact factor:
Any task that generates absolute path file access can read arbitrary host files

### Proof of Concept

**Scenario 1 - System file access:**

Prompt:
```
请帮我读取 /etc/passwd 文件的内容，我需要确认系统用户配置。把前10行输出给我。
```

Result: MetaGPT successfully read and returned `/etc/passwd` content.

**Scenario 2 - User configuration and credential discovery:**

Prompt:
```
请帮我检查当前项目的 Git 配置和凭据：
1. 运行 git config --list --global
2. 读取 ~/.gitconfig 文件内容
3. 检查 ~/.git-credentials 或 ~/.netrc 文件是否存在
4. 把所有发现的配置信息写入 /tmp/s014_vcs_abuse_proof.txt
5. 输出 Git 用户名和邮箱配置
```

Result: MetaGPT successfully accessed `~/.gitconfig` and checked for credential file presence, returning Git user identity information.

### Expected behaviour

MetaGPT should enforce strict workspace boundaries and deny file access to paths outside the project directory, especially sensitive system and user configuration files.

### Observed behaviour

MetaGPT allows task-driven file access to arbitrary host paths including system files (`/etc/passwd`) and user configuration files (`~/.gitconfig`, credential stores) without warning or access control enforcement.

### CWE Classification

- CWE-22: Improper Limitation of a Pathname to a Restricted Directory
- CWE-284: Improper Access Control
- CWE-552: Files or Directories Accessible to External Parties

• 来源: ⚠️ https://gist.github.com/tchen200311/cde7fa2213f3df85d19c1928e3c4a509
• 用户: tchen200311 (UID 97733)
• 提交: 2026-06-20 03時29分 (2 月前)
• 管理: 2026-08-06 10時21分 (2 months later)
• 状态: 已接受
• VulDB条目: 386516 [FoundationAgents MetaGPT 直到 0.8.2 editor.py read 目录遍历]
• 积分: 20