Agent Zero EUVD-2026-90425

The flaw is a default-configuration design defect: FileBrowser.__init__ sets the workspace to the host root directory, so no special feature toggle or non-default setting is required for the agent to reach any file on the system. The principal LIMITING factor is reachability - an attacker must be able to interact with the agent-zero file-browser interface; because agent-zero is frequently run as a local single-operator tool rather than a network-exposed service, the AV:N/PR:N modeling only holds where the UI is deliberately exposed to untrusted networks without an authentication layer. No user interaction and no authentication are required by the supplied vector against affected versions 1.7, 1.8, 1.9, and 1.10.

Signals are mixed and point to a moderate, not emergency, priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5) models an unauthenticated network-reachable information-disclosure flaw, but this is a design-level issue (FileBrowser initializes its workspace at the host root), so real exploitability hinges entirely on whether the agent-zero web interface is actually exposed to the attacker - many agent-zero deployments run locally for a single operator, which the AV:N/PR:N vector does not capture. EPSS is low (0.33%, 24th percentile), consistent with a niche open-source target rather than mass exploitation. It is NOT in CISA KEV, so there is no confirmed active exploitation. A public gist (Ro1ME) is referenced alongside the upstream GitHub issue, which strongly suggests exploit/PoC detail is publicly available, though no explicit POC flag was provided in the input - treat exploit-code availability as inferred from the gist reference, not confirmed. Net: a legitimate confidentiality bug worth patching, but the network-vector/no-privileges framing likely overstates risk for the common local-deployment case - verify exposure before prioritizing.

An attacker who can reach an exposed agent-zero instance (1.7-1.10) uses the agent's file-browser capability, whose workspace is rooted at the host filesystem root rather than a sandboxed directory, to read arbitrary files such as /etc/passwd, SSH keys, or application secrets. A public gist appears to document the technique, lowering the effort required. No authentication or user interaction is modeled in the supplied CVSS vector.