CVE-2026-51852

Deferred Deferred - Pending Action

Directory Traversal in agent-zero File Browser

Publication date: 2026-09-30

Last updated on: 2026-10-07

Assigner: MITRE

Description

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51852

Affected Vendors & Products

Vendor	Product	Version / Range
agent-zero	agent-zero	1.7
agent-zero	agent-zero	1.8
agent-zero	agent-zero	1.9
agent-zero	agent-zero	1.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

The vulnerability in agent-zero versions 1.7 to 1.10 allows a Directory Traversal attack through the FileBrowser.save_file_b64 function. This function accepts user-controlled file paths without proper validation or normalization, enabling attackers to traverse outside intended directories and write files to arbitrary locations on the system.

Detection Guidance

To detect this vulnerability, inspect systems running agent-zero versions 1.7 to 1.10 for unusual file writes or unauthorized file access patterns. Check logs for requests to python/helpers/file_browser.py with base64-encoded file paths containing '..' or absolute paths. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files, plant malicious scripts, or access sensitive data by writing files to unintended locations. It may lead to remote code execution, data corruption, or unauthorized system access depending on the attacker's goals.

Compliance Impact

This vulnerability could potentially lead to unauthorized file access or modification, which may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) or HIPAA (e.g., unauthorized access to protected health information). However, specific compliance impacts depend on how the affected software is used in a given environment.

Mitigation Strategies

Immediately upgrade agent-zero to a patched version beyond 1.10. If upgrading is not possible, restrict access to the FileBrowser.save_file_b64 endpoint and validate all file paths to prevent traversal sequences like '..'. Monitor for suspicious file operations in the application directory.

Hi! I’m here to help you understand CVE-2026-51852. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70