Agent Zero versions 1.7 to 1.10 do not validate user-supplied file paths in the File Browser method save_text_file. An attacker who can reach the web interface can write files to arbitrary locations on the host, which can overwrite system or configuration files or plant executables. The CVE record rates this as High (CVSS 7.5) with no authentication required, but the vector is inconsistent with the method's write function and should be verified in the NVD record.
agent0ai · Agent Zero
Agent Zero versions 1.7 through 1.10 initialize the file browser with the host root directory as workspace. An attacker who can instruct the AI agent, for example through a crafted prompt, can read arbitrary files on the system, such as credentials or SSH keys, within the permissions of the Agent Zero process. The web UI endpoints involved can be reached without authentication in the reproduction notes, which increases exposure when the UI is reachable from a network.
agent0ai · Agent Zero
Agent Zero versions 1.7 to 1.10 contain a directory traversal flaw in the file browser method FileBrowser.save_file_b64 (python/helpers/file_browser.py). The method uses user-supplied file paths without normalization or validation. An attacker who can send requests to the web interface, or who can steer the AI agent through prompts, may write files outside the intended workspace, for example to cron or SSH configuration locations. The CVE record does not state which authentication conditions apply.
agent0ai · Agent Zero
