Live › vulnerability › CVE-2026-51851
Agent Zero versions 1.7 through 1.10 accept user-supplied file paths in its file browser's save function without normalizing or validating them. An attacker can use traversal sequences to write files outside the intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.
Anyone running Agent Zero 1.7 to 1.10 where the web UI is reachable by people you do not trust. The file editor endpoint (/edit_work_dir_file) calls save_text_file, which can write anywhere the Agent Zero process can write, because the file browser root is the whole filesystem. It needs a CSRF token from /csrf_token, which the UI hands out, and I found no sign that login is required by default. Local-only, single-user installs behind authentication carry lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| agent-zero | github | >= 1.7, <= 1.10 | – |
git -C agent-zero describe --tags or check the Docker image tag: 1.7 to 1.10 is in the rangeNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-51851")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.