Executive Summary

The vulnerability exists in Evolver, a GEP-powered self-evolving engine for AI agents, specifically in versions prior to 1.69.3. It is a path traversal vulnerability in the skill download (fetch) command. The issue arises because the --out= flag accepts user-provided file paths without proper validation, allowing attackers to perform directory traversal attacks. This means attackers can write files to arbitrary locations on the filesystem, potentially overwriting critical system files or creating files in sensitive locations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by allowing attackers to write or overwrite files anywhere on the filesystem. This can lead to the corruption or replacement of critical system files, potentially causing system instability, unauthorized code execution, or denial of service. Because the attacker can place files in sensitive locations, it may also facilitate further attacks or persistence on the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Evolver to version 1.69.3 or later, where the path traversal issue in the skill download (fetch) command has been patched.

Avoid using the --out= flag with untrusted input to prevent directory traversal attacks that could overwrite critical system files or create files in sensitive locations.

Useful 0 Not Useful 0