EUVD-2026-77244
GHSA-qr7w-g3j4-2vq2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with no authentication required (PR:N, AV:N, AC:L); C/I/A all Low reflecting OS permission bounds on the server process rather than full system compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike_server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in HexStrike AI's FileOperationsManager API endpoint allows unauthenticated remote attackers to read, write, modify, and delete files outside the intended sandbox directory by supplying .. sequences in the filename parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The hexstrike_server.py API Files Endpoint must be reachable over a network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, unauthenticated, zero-complexity exploitation - a high inherent severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from GitHub pull request #159 (https://github.com/0x4m4/hexstrike-ai/pull/159), which introduces the `_validate_path()` method to all file operation calls in FileOperationsManager. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hexstrike Ai
View allOS command injection in HexStrike AI's Execute Endpoint allows remote unauthenticated attackers to execute arbitrary ope
OS command injection in 0x4m4 HexStrike AI allows unauthenticated remote attackers to execute arbitrary shell commands b
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today