EUVD-2026-12538Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A Server-Side Request Forgery (SSRF) vulnerability exists in frdel/agent-zero version 0.9.7 within the handle_pdf_document function of python/helpers/document_query.py. This allows authenticated remote attackers to manipulate PDF document handling to perform arbitrary server-side requests, potentially accessing internal services or exfiltrating sensitive data. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure notifications, increasing the practical risk of exploitation.
Technical ContextAI
The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), which occurs when an application fails to properly validate user-supplied input used in constructing server-side HTTP or network requests. Agent-Zero is a Python-based AI agent framework (identifiable via CPE cpe:2.3:a:frdel:agent-zero and cpe:2.3:a:agent0ai:agent-zero), and the flaw is specifically in the PDF document query helper module. The handle_pdf_document function lacks adequate input validation when processing PDF inputs, allowing attackers to inject malicious URLs or request parameters. Python applications leveraging network libraries (requests, urllib) without strict validation are particularly susceptible to SSRF when processing user-controlled file references or embedded URLs within documents.
RemediationAI
Immediately upgrade Agent-Zero to a patched version released after 0.9.7 (check the frdel/agent-zero GitHub repository at https://github.com/frdel/agent-zero for availability). Until an official patch is released, implement the following mitigations: (1) Restrict network access to Agent-Zero instances using firewall rules to prevent outbound connections to unexpected destinations; (2) Disable or restrict the PDF document handling feature if not required for operational use; (3) Enforce strict input validation on all document uploads, limiting accepted file types and validating internal references; (4) Deploy Agent-Zero behind a reverse proxy configured with outbound connection filtering to prevent SSRF payloads from reaching internal services; (5) Monitor network logs for anomalous outbound requests from Agent-Zero processes. The lack of vendor response suggests relying on community patches or forks may be necessary if official updates remain unavailable.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today