Agent Zero: Directory traversal via host root workspace in file browser
Summary
Agent Zero versions 1.7 through 1.10 initialize the file browser with the host root directory as workspace. An attacker who can instruct the AI agent, for example through a crafted prompt, can read arbitrary files on the system, such as credentials or SSH keys, within the permissions of the Agent Zero process. The web UI endpoints involved can be reached without authentication in the reproduction notes, which increases exposure when the UI is reachable from a network.
Affected
- Agent Zero 1.7
- Agent Zero 1.8
- Agent Zero 1.9
- Agent Zero 1.10
- Component: python/helpers/file_browser.py, FileBrowser.__init__
Fixed in
Unknown. No vendor advisory or release note confirming a fix for this CVE was found.
Workaround
- No vendor-documented workaround found.
- Do not expose the Agent Zero web UI to the internet; restrict access to VPN, localhost or internal networks and place authentication in front of it.
- Run Agent Zero in a container or VM without mounts of sensitive host paths.
Exploitation
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: partial.
- No evidence of exploitation in the wild found; not listed in KEV.
- Issue #1539 describes prompts asking the agent to read /etc/shadow and SSH keys.
Our recommendation
- Check whether Agent Zero 1.7 to 1.10 is in use, including test and development instances.
- Restrict network access to the web UI and add authentication.
- Upgrade to the latest upstream release and verify the fix in issue #1539 before relying on it.
- Remove mounts of sensitive host paths and limit the agent's file and credential access.
- Review agent logs for file access outside the project folder.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51853 gist (third-party, unreviewed) gist.github.com
- agent0ai/agent-zero issue #1539 github.com
- Vulners VulnRichment CVE-2026-51853 vulners.com
- Strix CVE-2026-51853 www.strix.ai
- agent-zero releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 23:58.
Original description (NVD)
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.