EUVD-2026-91129
GHSA-5xcr-qppv-2p66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Devika agent endpoint
-
DeliverySubmit task with traversal filename
-
Exploitsave_code_to_project writes outside workspace
-
ExecutionOverwrite executable/config path
-
ImpactAchieve code execution on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to be able to submit a task/feature request to a Devika v1.0 instance such that the Feature Agent's save_code_to_project routine processes an attacker-influenced output filename containing path-traversal sequences; no authentication is indicated by the CVSS vector (PR:N). The primary limiting factor is deployment reality: Devika is typically run as a local, single-developer tool bound to localhost, so remote reach depends on the operator exposing the web UI/API to a network. There is no indication of a non-default configuration requirement beyond network reachability, and the scored UI:N means no victim interaction is needed once the agent is reachable. |
| Impact | Signals conflict and require careful weighting. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.1 and implies trivial remote unauthenticated exploitation, and SSVC reinforces concern (Automatable: yes, Technical Impact: total). However, EPSS is only 0.14% (3rd percentile), the CVE is NOT on the CISA KEV list, and exploitation status is merely 'poc' - so despite the critical score this is not evidence of widespread active exploitation. The low EPSS combined with POC-only status and the nature of the affected product (Devika, an open-source experimental AI coding agent) suggests real-world risk is far lower than the 9.1 implies: the mitigating factor is prevalence, not exploitability. There is also tension between the scored PR:N and deployment reality - Devika is normally run as a local/single-user developer tool, so network-reachable unauthenticated exposure depends on the operator binding it to a reachable interface. Bottom line: technically a serious arbitrary-file-write flaw with a public POC, but a priority only for the specific population running Devika v1.0, and the absence of KEV listing plus very low EPSS argue against treating it as an urgent broad-exposure emergency. |
| Exploit ScenarioDerived | An attacker who can reach a Devika v1.0 instance drives the Feature Agent to save generated code using a filename containing traversal sequences (e.g. ../../), causing save_code_to_project to write attacker-controlled files outside the project workspace - for example into a startup, cron, or import path - leading to server compromise. A public POC exists (gist referenced in the advisory) and SSVC rates exploitation as POC and automatable, so weaponization effort is low. Realistic reachability depends on whether the Devika instance is exposed beyond localhost. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Path traversal in the Devika v1.0 Feature Agent's save_code_to_project routine lets a remote caller who can submit a task or feature request to a Devika instance cause the agent to write files outside the intended project workspace, using the privileges of the local Devika process. The flaw is unauthenticated per the scored CVSS vector (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists; CISA's SSVC rates it automatable with total technical impact, although EPSS is low at 0.14% (3rd percentile) and there is no KEV confirmation of active exploitation. Our independent assessment rates confidentiality impact as limited while integrity and availability impacts are high, and the decisive real-world factor is exposure: Devika is normally a single-developer tool bound to localhost, so remote exploitation depends on an operator having published the web UI/API to a network.
RemediationAI
No vendor-released patch or fixed version appears in the available intelligence - Devika is at v1.0 and the linked GitHub issue is a project bug report rather than a shipped patched release - so remediation must currently rely on exposure reduction and sandboxing. The most effective step is to eliminate network reachability of the vulnerable agent: bind the Devika web UI/API to 127.0.0.1, or front it with an authenticating reverse proxy restricted to trusted operators, which neutralizes the unauthenticated remote (PR:N) attack path at the cost of remote or multi-user access. Second, run Devika as a dedicated unprivileged user inside a container or sandbox with the project directory as the only writable mount and the remainder of the filesystem read-only or unmounted; because this CVE is fundamentally an arbitrary-file-write constrained by process permissions, containment caps the blast radius at a disposable workspace, with the trade-off that some legitimate agent workflows requiring broader write access will fail. Third, if version 1.0 must remain in service, do not feed the Feature Agent untrusted prompts or task inputs, and deploy file-integrity monitoring on sensitive directories (/etc, ~/.ssh, cron and systemd unit paths, application startup scripts) to detect writes landing outside the workspace, accepting that detection is after-the-fact. Finally, track https://github.com/stitionai/devika/issues/708 for an upstream fix and, once available, upgrade and verify that output paths are canonicalized and validated against the workspace root before any file is persisted; background is available at https://nvd.nist.gov/vuln/detail/CVE-2026-51875 and https://gist.github.com/Ro1ME/f667dcf8c3f4852900fa7811944f0f3f.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Devika is an open-source agentic AI software-engineering assistant that orchestrates LLM-driven agents, one of which - the Feature Agent - generates code and persists it into the user's project through the save_code_to_project function. That function constructs a destination path from an attacker-influenceable output filename without canonicalizing it or confining it beneath the project root, which is the classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) root cause: sequences such as ../ escape the workspace and turn a normal code-write into an arbitrary-file-write primitive bounded only by the permissions of the Devika process. The provided CPE entry is an unresolved placeholder (cpe:2.3:a:n/a:n/a:*), so product and version identification rests on the description and ENISA EUVD record, which both point to Devika v1.0. Because arbitrary file writes can be chained into code execution when they overwrite content that is later executed or sourced by the server, shell, or scheduler, our assessment keeps integrity and availability impact High while holding confidentiality at Low - the primitive demonstrably corrupts or replaces files but does not by itself guarantee credential or data exfiltration. The public write-up (gist referenced from the CVE) and the upstream project issue indicate the vulnerable path-handling logic is reachable from ordinary agent task processing.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Write-primitive path traversal: integrity high; overwriting executables/config escalates to code execution giving A:H; direct read not provided so C:L; PR:N as Devika ships without auth.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.
Executive ViewAI
Devika v1.0, a developer tool, contains a critical unauthenticated path traversal vulnerability (CVE-2026-51875) that allows remote attackers to write arbitrary files on the host system, potentially leading to full system compromise. While typically deployed locally, any instance exposed to a network is at immediate risk, and no vendor-released patch identified at time of analysis. Leadership should prioritize identifying exposed instances and applying interim mitigations to prevent unauthorized access and potential data integrity or availability incidents.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to localhost or trusted networks, deploying a WAF with path traversal signatures, monitoring file system for unauthorized writes, and running the Devika process with least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB