Devika: Directory traversal in Coder agent file save function
Summary
Devika v1.0 contains a directory traversal vulnerability (CWE-22) in the Coder.save_code_to_project function. The function writes LLM-generated file paths without normalization or boundary checks, so an attacker can write files outside the project workspace. Public sources indicate the issue can be triggered through manipulated prompts, which Devika feeds with web content; the CVSS score is 8.8 and a public PoC is likely but unverified.
Affected
- Devika v1.0
- Component: src/agents/coder/coder.py, Coder.save_code_to_project
- Other versions: Unknown.
Fixed in
Unknown. No fixed version or vendor patch has been published.
Workaround
- Modify save_code_to_project to reject paths containing '..' or absolute paths (requires code change).
- Restrict filesystem permissions so the Devika process can only write to its designated workspace.
- Run Devika only in an isolated container or VM under a low-privilege user.
Exploitation
- Known exploited: No (not in the CISA KEV catalog).
- Public PoC: Conflicting; a PoC is referenced but its contents could not be verified.
- CISA SSVC: Exploitation poc, automatable no, technical impact total.
Our recommendation
- Inventory all Devika installations and determine whether v1.0 is in use.
- Remove Devika from shared, production, or CI hosts or isolate it as described above until a fix is confirmed.
- Do not expose the Devika web interface to the internet.
- Monitor the GitHub issue #707 and the project for a fix and apply it as soon as it is released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Gist: CVE-2026-51873 write-up gist.github.com
- GitHub Issue #707: Coder Agent path traversal github.com
- OpenCVE: CVE-2026-51873 app.opencve.io
- HOL Guard: CVE-2026-51873 (CISA ADP Vulnrichment) hol.org
- Devika repository github.com
- The Hacker Wire: CVE-2026-51873 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:53.
Original description (NVD)
Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.