---
id: "CVE-2026-51851"
kind: "vulnerability"
aliases: ["CVE-2026-51851"]
title: "Agent Zero: directory traversal lets file writes escape the intended folder"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "agent-zero", "fixed": [], "affected": ">= 1.7, <= 1.10", "ecosystem": "github"}]
ecosystems: []
tags: ["agent-zero", "ai-tooling", "path-traversal", "python", "self-hosted"]
not_affected_if: ["version-outside-1.7-1.10"]
published_at: "2026-10-29T18:17:32+00:00"
first_seen_at: "2026-10-29T18:26:33+00:00"
updated_at: "2026-10-29T18:31:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51851", "first_seen_at": "2026-10-29T18:26:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T18:31:13+00:00"}]
---

# Agent Zero: directory traversal lets file writes escape the intended folder

Agent Zero versions 1.7 through 1.10 accept user-supplied file paths in its file browser's save function without normalizing or validating them. An attacker can use traversal sequences to write files outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:agent-zero affected >= 1.7, <= 1.10 fixed ?

## How to check

Run 'git -C agent-zero describe --tags' or check the Docker image tag: 1.7 to 1.10 is in the range. Check whether the web UI port is reachable from untrusted networks. Look at helpers/file_browser.py: if FileBrowser.base_dir is Path('/'), the containment check in save_text_file does not restrict writes.

## Timeline

- 2026-10-29T18:26:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-51851
- 2026-10-29T18:31:13+00:00 analyst — Upstream issue #1541 (open as last seen, 2026-04-24) has a runtime HTTP PoC: POST /edit_work_dir_file with CSRF token from GET /csrf_token wrote a file outside the workspace. FileBrowser base_dir is '/', so the startswith check does nothing. PR #1555 is referenced but I could not read it, so merge status and fixed version are unconfirmed. CVE-2026-51852 and -51853 are siblings in the same file. Nothing verified: no vendor advisory found.

## Documents

- [poc] Bug: Path Traversal in save_text_file (agent0ai/agent-zero #1541) https://github.com/agent0ai/agent-zero/issues/1541

## From the sources

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_