EUVD-2026-67269
GHSA-v667-mxv8-67r8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker controls agent input
-
DeliveryInject filename with ../ or absolute path
-
ExploitFileWriterTool writes outside target dir
-
ExecutionOverwrite code/config/startup file
-
PersistInjected code executed
-
ImpactCompromise host process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the crewAI FileWriterTool to be enabled in the agent setup and for the attacker to control (directly or via prompt injection) the filename argument passed to it; the traversal payload is a '../' sequence, an absolute path, or a path through a symlink in that filename. Exploitation is limited by whether the agent is exposed to attacker-influenced input, the OS permissions of the process running the agent (writes are confined to what that user can write), and whether an overwritten file is actually loaded/executed to escalate the write into code execution. Affected versions are crewai-tools <= 1.10.2rc1. |
| Impact | The assigned CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects a worst-case network, unauthenticated, full-impact scenario, but the real-world signals are more mixed. EPSS is low (0.26%, 17th percentile), there is no KEV listing, and no public POC is referenced - only a vendor commit and a third-party writeup. The direct primitive is an arbitrary file *write*; confidentiality impact (C:H) is indirect, realized only by chaining the write into code execution (e.g., overwriting a Python module, startup script, or crontab). Exploitability is also gated by deployment: FileWriterTool must be enabled and reachable by attacker-influenced input, which in agent frameworks typically means prompt injection rather than a direct network request - so AV:N/PR:N somewhat overstates how 'remote and unauthenticated' this is in practice. Treat as a genuine high-priority fix for anyone running crewAI agents that process untrusted input, but not an internet-wide mass-exploitation event. |
| Exploit ScenarioDerived | A crewAI agent that summarizes and saves user-supplied documents is fed a malicious document (or a web page during a browsing task) whose content instructs the agent to call FileWriterTool with filename '../../../home/app/.bashrc' or an absolute path to a Python module. The tool writes attacker-controlled content outside the intended directory, and when that file is next loaded or the user logs in, the injected code executes. No public POC is referenced, but the primitive is straightforward given AC:L. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Arbitrary file write leading to code execution in crewai-tools' FileWriterTool (crewAI agent-tools package) through 1.10.2rc1 lets an attacker supply path-traversal sequences (../), absolute paths, or symlink escapes in the tool's filename argument to write content anywhere the process can reach. Because these tools are driven by LLM agents, the practical trigger is untrusted/injected content steering the agent to write outside its intended directory, overwriting code or config to gain execution. No public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile) and it is not in CISA KEV.
RemediationAI
Upstream fix available (commit 713fa7d); a released patched version is not independently confirmed from the input, so upgrade crewai-tools to the first tagged release above 1.10.2rc1 that includes commit 713fa7d (verify against the project's release notes before deploying). Until upgraded, restrict or disable FileWriterTool in agent configurations that process untrusted or externally-influenced input; run agents under a low-privilege account in a sandbox/container with a read-only filesystem outside a dedicated writable output directory, which prevents traversal from reaching sensitive code/config at the cost of blocking legitimate writes elsewhere; and validate/normalize any filename passed to the tool (reject '..', absolute paths, and symlinks) if you cannot upgrade immediately. See https://github.com/crewAIInc/crewAI/commit/713fa7d and https://nvd.nist.gov/vuln/detail/CVE-2026-37007.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
crewai-tools is the tools package for the crewAI multi-agent framework; FileWriterTool is a built-in tool agents call to persist output to disk. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the vulnerable code did os.path.join(directory, filename) and wrote directly, so a filename containing '../', an absolute path, or a symlinked component escaped the intended target directory with no containment check. The fix (commit 713fa7d) resolves both the directory and the final path with pathlib and enforces real_filepath.is_relative_to(real_directory), rejecting traversal, absolute-path injection, and symlink escape. CPE data is a placeholder (cpe:2.3:a:n/a:n/a) and the exact affected product must be read from the commit path (lib/crewai-tools) rather than the metadata.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable via network-fed agent input but requires FileWriterTool enabled and attacker-controlled filename (AC:H); primitive is arbitrary write (I:H/A:H) with only indirect confidentiality (C:L) via RCE chaining.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
Executive ViewAI
crewai-tools deployments expose organizations to remote code execution through LLM-agent-driven prompt injection. Any organization using this package for AI-driven automation faces material risk of unauthorized file modification and system compromise, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict FileWriterTool to internal-only agent instances; disable public-facing LLM integrations; (2) deploy filesystem sandboxing (containerization with read-only root, AppArmor, or SELinux) to prevent writes outside a whitelisted directory; (3) filter all user-supplied prompts and LLM outputs for path-traversal patterns (../, absolute paths, symlink references) before they reach FileWriterTool; (4) implement comprehensive logging of all file-write operations to detect and alert on anomalous behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB