EUVD-2026-17419
GHSA-7gc4-v478-jrmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application
-
ExploitSupply malicious checkpoint_dir with traversal sequences
-
ExecutionWrite arbitrary file via save_to_file method
-
ImpactOverwrite critical files or execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (PR:L) to agentic-context-engine versions ≤0.7.1. Attacker must supply a malicious checkpoint_dir parameter containing path traversal sequences (../) to OfflineACE.run(). The application must have write permissions to target files for exploitation to succeed. |
| Impact | Real-world risk assessment is constrained by missing CVSS vector, EPSS score, and CISA KEV confirmation in provided intelligence. However, the vulnerability presents significant practical risk: (1) Attack vector is likely network-accessible if checkpoint_dir is user-controllable through an API or command-line interface; (2) No authentication requirement is evident from the description (save_to_file appears to be called within OfflineACE.run without auth gates); (3) File write capability enables cascading impacts-overwriting application configuration files, executable scripts, or startup routines could lead to code execution; (4) Proof-of-concept is referenced in the GitHub security-research repository, indicating public exploit code availability. The lack of formal CVSS/EPSS data suggests this is either a recently disclosed or community-identified vulnerability not yet formally scored by NVD. For organizations using agentic-context-engine in production or untrusted environments, this merits immediate patching despite missing CVSS quantification. |
| Exploit ScenarioDerived | An attacker controlling or influencing the checkpoint_dir parameter (e.g., via an API endpoint, config file, or command-line argument) supplies a traversal sequence such as '../../config/startup.sh' to OfflineACE.run. The save_to_file method fails to normalize this path and writes attacker-supplied content to the startup script outside the intended checkpoint directory. On next application restart, the malicious startup script executes with the application's process privileges, establishing code execution and potential privilege escalation if the application runs with elevated rights. Proof-of-concept code is publicly available in the referenced GitHub security-research repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Directory traversal in agentic-context-engine up to version 0.7.1 enables arbitrary file writes through the checkpoint_dir parameter in OfflineACE.run, exploiting inadequate path normalization in the save_to_file method. Unauthenticated attackers can overwrite arbitrary files within the application process's permissions scope, potentially achieving code execution, privilege escalation, or application compromise depending on deployment context and file system layout.
RemediationAI
Upgrade agentic-context-engine to a version released after 0.7.1 that includes path validation fixes. Immediate mitigations include: (1) normalize all checkpoint_dir input using os.path.abspath() or pathlib.Path.resolve() to convert relative paths to absolute form, then verify the resolved path remains within the intended checkpoint directory using os.path.commonpath() or similar; (2) restrict checkpoint_dir to a whitelist of allowed directories or enforce strict directory naming conventions without path separators; (3) run the application with minimal filesystem permissions (principle of least privilege) to limit the blast radius of file overwrites. Contact the agentic-context-engine maintainers or monitor the GitHub repository (https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29870.md) for a patched release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the ace/skillbook.py module's save_to_file method, which processes user-supplied checkpoint_dir parameters without canonicalizing or validating filesystem paths. The root cause is improper input validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) that fails to prevent directory traversal sequences (e.g., '../', '..\') from escaping the intended checkpoint directory boundary. This is a classic path traversal flaw where relative path components are not resolved to their canonical absolute forms before file operations. The affected product, agentic-context-engine, appears to be a Python-based framework for autonomous agents; CPE data is incomplete in available intelligence, indicating either a private/internal project or missing MITRE registration metadata.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
DescriptionCVE.org
A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run. The save_to_file method in ace/skillbook.py fails to normalize or validate filesystem paths, allowing traversal sequences to escape the intended checkpoint directory. This vulnerability allows attackers to overwrite arbitrary files accessible to the application process, potentially leading to application corruption, privilege escalation, or code execution depending on the deployment context.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB