Is there a public PoC exploit available for CVE-2026-5998?

Yes, a public proof-of-concept exploit is available for CVE-2026-5998. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-5998?

Yes, a patch is available for CVE-2026-5998. Update the affected software to the latest version immediately.

Chatgpt On Wechat Cowagent CVE-2026-5998

Q: What is the CVSS score of CVE-2026-5998?

CVE-2026-5998 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21277 MEDIUM

Path Traversal (CWE-22)

2026-04-10 VulDB

GHSA-m63g-rhjw-f2v6

Path Traversal Chatgpt On Wechat Cowagent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 10, 2026 - 02:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21277

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

Patch released

Apr 10, 2026 - 01:45 nvd

Patch available

CVE Published

Apr 10, 2026 - 01:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.0.5 mitigates this issue. Patch name: 174ee0cafc9e8e9d97a23c305418251485b8aa89. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Path traversal in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows unauthenticated remote attackers to read arbitrary files via the filename parameter in the API Memory Content Endpoint (agent/memory/service.py). The vulnerability has a publicly available exploit, carries a moderate CVSS score of 5.3 reflecting limited confidentiality impact, and has been patched by the vendor in version 2.0.5 with patch commit 174ee0cafc9e8e9d97a23c305418251485b8aa89.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS score of 5.3 with vector AV:N/AC:L/PR:N/UI:N reflects a network-exploitable vulnerability with low attack complexity requiring no privileges or user interaction, but impact is limited to confidentiality (C:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker can craft a request to the API Memory Content Endpoint with a malicious filename parameter containing path traversal sequences (e.g., ../../../../etc/passwd or an absolute path). The vulnerable dispatch function fails to validate the filename input, allowing the attacker to read arbitrary files accessible to the application process, such as configuration files containing API keys, environment variables, or application source code. …
Remediation	Vendor-released patch: upgrade to version 2.0.5 or later, which is available at https://github.com/zhayujie/chatgpt-on-wechat/releases/tag/2.0.5. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-5998 vulnerability details – vuln.today

Back