Devika: Path traversal in Feature Agent allows arbitrary file write
Summary
Devika v1.0 contains a path traversal flaw in the Feature Agent function save_code_to_project. Input used to build file paths is not validated, so an attacker can write files outside the project workspace, potentially overwriting Python modules or startup scripts on the host. The NVD and CISA SSVC data indicate network attack vector, low complexity and no privileges required, and a public proof of concept exists. Whether authentication is required is unverified.
Affected
- Devika v1.0 (according to the CVE description)
- Component: src/agents/feature/feature.py, Feature.save_code_to_project
- Exact scope of other versions: Unknown.
Fixed in
Unknown. No fixed version or vendor advisory was found.
Workaround
- No vendor workaround found.
- Do not expose Devika to the internet, LAN or untrusted users.
- Run it in an isolated container or VM with a non-privileged account and no write access to system, startup or other application directories.
- Restrict outbound network access.
Exploitation
- CISA SSVC: exploitation 'poc', automatable 'yes', technical impact 'total'.
- A proof of concept exists.
- Not known to be exploited in the wild; not listed in KEV.
Our recommendation
- Check whether Devika is installed on any server or workstation and treat it as high priority.
- Remove it, or isolate it as described above, until a fixed version is confirmed.
- Monitor for unexpected file writes outside the project directory.
- Check the GitHub issue and repository for a fix before reinstating it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51875 Gist (Ro1ME) gist.github.com
- Devika Issue #708 github.com
- OpenCVE CVE-2026-51875 app.opencve.io
- HOL Guard CVE-2026-51875 (CISA ADP) hol.org
- Strix CVE-2026-51875 www.strix.ai
- Devika repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:41.
Original description (NVD)
In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.