EUVD-2026-96864
GHSA-624w-5pqv-45mm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain authenticated access to ag2 agent interface
-
DeliverySubmit crafted filename with traversal sequences
-
Exploitos.path.join resolves path outside working dir
-
ExecutionRead or write arbitrary file
-
ImpactLimited disclosure or file tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the host application using ag2 ≤0.13.4 routes attacker-influenced input into the filename argument consumed by os.path.join inside UserProxyAgent; without that exposure the in-process library code is not reachable by an external attacker. Limiting factors: the CVSS vector specifies PR:L, so some level of authenticated or authorized interaction with the agent is needed, and impact is bounded to low-severity file read/write within the process's file-system permissions. The referenced PoC specifically involves legacy filename handling in a Docker environment, implying containerized deployments that pass through such filenames are the realistic target. |
| Impact | This is a moderate, low-priority issue despite having public exploit code. The only severity signal provided is a VulDB-authored CVSS 4.0 vector (5.3) of AV:N/AC:L/AT:N/PR:L/UI:N with uniformly LOW impacts (VC:L/VI:L/VA:L) and E:P (proof-of-concept exploit maturity) - meaning network-reachable but requiring some privilege and yielding only limited confidentiality/integrity/availability effect, consistent with CWE-22 path traversal in a developer library rather than a server appliance. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation; the signals point to a disclosed-but-not-weaponized library bug. Conflicts to verify: the description says the attack 'is possible to be carried out remotely' yet the flaw is in an in-process library function (os.path.join within UserProxyAgent), so true remoteness depends entirely on whether the host application exposes that filename argument to untrusted input - verify against actual deployment. Also note the VA:L (availability) rating is questionable for a path-traversal read/write primitive and appears to be VulDB's conservative auto-scoring rather than a demonstrated impact. |
| Exploit ScenarioDerived | An application built on ag2 (≤0.13.4) exposes the UserProxyAgent file-handling path to attacker-influenced input (e.g., an agent task or document whose filename field is user-controlled). The attacker supplies a crafted filename containing traversal sequences (../) so os.path.join resolves outside the intended working directory, letting them read or write files at unintended locations. Public proof-of-concept exploit code describing this (legacy filename handling in a Docker environment) has been disclosed on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Path traversal in ag2ai AG2 through version 0.13.4 allows an attacker who can influence the filename argument consumed by UserProxyAgent's os.path.join call to escape the intended working directory and read or write files with the privileges of the host process. Impact is bounded rather than catastrophic: the CVSS vector specifies PR:L, so some authorized or authenticated interaction with the agent is required, and the host application must route attacker-influenced input into that filename argument, meaning the in-process library code is not directly reachable by an unauthenticated remote attacker. Publicly available exploit code exists (a public report demonstrating legacy filename handling in a Docker environment), but there is no confirmed active exploitation and no CISA KEV listing; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis and the vendor did not respond to the disclosure, so remediation must be compensating until an upstream fix appears (monitor the ag2ai/ag2 project and VulDB entry https://vuldb.com/vuln/416198 for a patched release). The most direct control is to sanitize the filename before it reaches UserProxyAgent: reject absolute paths, strip or reject any ../ and ..\ sequence, resolve the candidate with os.path.realpath and verify it remains inside a dedicated base directory, and generate filenames server-side rather than accepting them from callers; the trade-off is that legitimate symlink-based or cross-directory workflows will break, and overly strict normalization can itself be bypassed if applied after, rather than before, path joining. If the agent does not need file handling, disable or remove the file-related tool/function from UserProxyAgent, which eliminates the vulnerable path entirely at the cost of losing that functionality. Where the feature must stay, run the agent in a container with a read-only root filesystem, a narrowly scoped writable volume, a non-root user, and dropped Linux capabilities so a successful traversal only reaches a minimal, disposable fileset; this limits blast radius but does not remove the flaw and can break workloads that legitimately write outside the designated volume. Finally, enforce least-privilege filesystem permissions on the process account and monitor for anomalous file access outside the expected working directory, accepting that such detection is a detective rather than preventive control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 path traversal rooted in unsafe use of os.path.join inside the UserProxyAgent component of AG2 (ag2ai/ag2), an open-source multi-agent conversation/orchestration framework. When a filename argument is attacker-influenced, os.path.join does not sanitize it: an absolute path silently discards all preceding path components, and sequences such as ../ traverse upward out of the intended base directory, so the resulting path can point anywhere the process can reach. Because AG2 is a library embedded in a host application rather than a network service, the vulnerable call is only exposed when the surrounding application forwards external input into that argument; the CPE record cpe:2.3:a:ag2ai:ag2:*:*:*:*:*:*:*:* covers all AG2 builds up to and including 0.13.4. The published proof-of-concept centers on legacy filename handling within a Docker (.dockerenv-style) environment, which indicates containerized deployments that pass such filenames through to the agent are the realistic exploitation surface; the CVSS 4.0 vector carries E:P (proof-of-concept exploit maturity) and PR:L, and the assessed impact (C:L/I:L/A:L in 4.0, C:L/I:L in the 3.1 assessment) reflects low-severity file read/write confined to the permissions of the hosting process.
Know when Ag2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Reachable over the network only through an application that feeds attacker-controlled filenames (PR:L for required agent interaction); traversal yields limited file read/write (C:L/I:L) with no genuine availability impact (A:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB