Google ADK TypeScript: Path traversal in FileArtifactService

Summary

The FileArtifactService of the Google ADK TypeScript library (@google/adk) versions 0.4.0 before 0.6.0 does not properly restrict the userId and sessionId parameters. A remote unauthenticated attacker can use crafted path traversal sequences to read files outside the artifact storage directory and, when an agent tool calls saveArtifact, write files there as well. The flaw applies only when the ADK API server is exposed and the non-default FileArtifactService is enabled; applications using the default InMemoryArtifactService are not affected.

Affected

• @google/adk versions 0.4.0 to before 0.6.0
• Only with the non-default FileArtifactService enabled and the ADK API server reachable
• Default InMemoryArtifactService: not affected
• Versions before 0.4.0: Unknown.

Fixed in

• Fixed in @google/adk 0.6.0
• Fix commits: 710b4eb and 8c0eaa1 (PR #210)

Workaround

• The CVE record and vendor sources list no workaround other than upgrading.
• Switch to the default InMemoryArtifactService if acceptable.
• Do not expose the ADK API server to untrusted networks until patched.

Exploitation

• Not known to be exploited; CISA SSVC lists exploitation as none and automatable as yes.
• Not listed in CISA KEV.
• No public proof of concept found in the research; this search was not exhaustive.

Our recommendation

• Search repositories and lockfiles for @google/adk versions 0.4.0 to 0.5.x and upgrade to 0.6.0 or later.
• Check whether the ADK API server is reachable from the internet and restrict access immediately.
• If FileArtifactService is in use, review artifact directories for unexpected files and monitor for suspicious requests with traversal sequences.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-8hc4-6xx6-3rh3 github.com
• Fix commit 8c0eaa1: prevent path traversal in FileArtifactService github.com
• Commit 710b4eb: Add FileArtifactService github.com
• Pull request #210 github.com
• OpenCVE entry CVE-2026-105772 app.opencve.io
• VulDB entry 422948 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:15.