{"id":"CVE-2026-51851","kind":"vulnerability","aliases":["CVE-2026-51851"],"related":[],"title":"Agent Zero: directory traversal lets file writes escape the intended folder","description":"modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.","summary":"Agent Zero versions 1.7 through 1.10 accept user-supplied file paths in its file browser's save function without normalizing or validating them. An attacker can use traversal sequences to write files outside the intended directory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agent-zero","fixed":[],"affected":">= 1.7, <= 1.10","ecosystem":"github"}],"ecosystems":[],"tags":["agent-zero","ai-tooling","path-traversal","python","self-hosted"],"not_affected_if":["version-outside-1.7-1.10"],"how_to_check":"Run 'git -C agent-zero describe --tags' or check the Docker image tag: 1.7 to 1.10 is in the range. Check whether the web UI port is reachable from untrusted networks. Look at helpers/file_browser.py: if FileBrowser.base_dir is Path('/'), the containment check in save_text_file does not restrict writes.","fix":null,"status":"open","published_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:33+00:00","triaged_at":"2026-10-29T18:28:54+00:00","updated_at":"2026-10-29T18:31:13+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T18:28:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Agent Zero: directory traversal lets file writes escape the intended folder","impact":"high","summary":"Agent Zero versions 1.7 through 1.10 accept user-supplied file paths in its file browser's save function without normalizing or validating them. An attacker can use traversal sequences to write files outside the intended directory.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["agent-zero","python","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker writes files anywhere the Agent Zero process can reach","analyst_note":"Confirm whether save_text_file is exposed over HTTP by default, whether auth is required, and whether a fixed version exists; check the NVD entry and upstream repository.","how_to_check":"- Check the installed Agent Zero version against the affected range 1.7, 1.8, 1.9 and 1.10 (e.g. `git -C agent-zero describe --tags` if run from source).\n- Review whether the file browser save endpoint in `python/helpers/file_browser.py` (FileBrowser.save_text_file) is reachable by untrusted users.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-1.7-1.10"],"who_is_affected":"Teams running Agent Zero versions 1.7 through 1.10 where the file browser's save function is reachable. The sources do not say whether the flaw needs an account or a non-default setting, so the exposure window is unknown. Teams on other versions or without the file browser exposed can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4134,"output_tokens":606,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm whether save_text_file is exposed over HTTP by default, whether auth is required, and whether a fixed version exists; check the NVD entry and upstream repository.","search":"'-2026':13A,16A '-51851':14A,17A '1.10':39B,79C '1.7':37B,75C '1.8':76C '1.9':77C 'accept':40B,95C 'agent':1A,19A,22B,34B,73C 'agent-zero':18A,21B,72C 'ai':25B 'ai-tool':24B 'allow':105C 'attack':59B,108C 'browser':49B 'control':98C 'cve':12A,15A 'directori':3A,70B,83C 'escap':8A 'file':6A,44B,48B,66B,89C,93C,99C 'filebrowser.save':87C 'folder':11A 'function':52B 'host':33B 'intend':10A,69B 'let':5A 'method':94C 'modelscop':71C 'normal':54B,102C 'outsid':67B 'path':28B,45B,100C,106C 'path-travers':27B 'python':30B 'python/helpers/file_browser.py':86C 'save':51B,91C 'self':32B 'self-host':31B 'sequenc':63B 'suppli':43B 'text':88C,92C 'tool':26B 'travers':4A,29B,62B,84C,107C 'use':61B 'user':42B,97C 'user-control':96C 'user-suppli':41B 'valid':56B,104C 'version':36B 'vulner':81C 'without':53B,101C 'write':7A,65B 'zero':2A,20A,23B,35B,74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Agent Zero 1.7 to 1.10 where the web UI is reachable by people you do not trust. The file editor endpoint (/edit_work_dir_file) calls save_text_file, which can write anywhere the Agent Zero process can write, because the file browser root is the whole filesystem. It needs a CSRF token from /csrf_token, which the UI hands out, and I found no sign that login is required by default. Local-only, single-user installs behind authentication carry lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T18:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-51851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51851","severity":null,"published_at":"2026-10-29T18:17:32+00:00","modified_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:33+00:00","fetched_at":"2026-10-29T18:26:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-51851:1095","url":null,"severity":null,"published_at":"2026-10-29T18:31:13+00:00","modified_at":"2026-10-29T18:31:13+00:00","first_seen_at":"2026-10-29T18:31:13+00:00","fetched_at":"2026-10-29T18:31:13+00:00","note":"Upstream issue #1541 (open as last seen, 2026-04-24) has a runtime HTTP PoC: POST /edit_work_dir_file with CSRF token from GET /csrf_token wrote a file outside the workspace. FileBrowser base_dir is '/', so the startswith check does nothing. PR #1555 is referenced but I could not read it, so merge status and fixed version are unconfirmed. CVE-2026-51852 and -51853 are siblings in the same file. Nothing verified: no vendor advisory found."}],"documents":[{"id":18586,"url":"https://github.com/agent0ai/agent-zero/issues/1541","title":"Bug: Path Traversal in save_text_file (agent0ai/agent-zero #1541)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}