CVE-2026-19059

Received Received - Intake

Path Traversal in FoundationAgents MetaGPT

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-19059

Affected Vendors & Products

Vendor	Product	Version / Range
foundationagents	metagpt	to 0.8.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in FoundationAgents MetaGPT up to version 0.8.2. It exists in the read function of the file metagpt/tools/libs/editor.py. Path traversal allows an attacker to access files outside the intended directory by manipulating file paths. The attack requires local access to the system.

Detection Guidance

Since this vulnerability involves path traversal in FoundationAgents MetaGPT up to version 0.8.2, detection should focus on checking for vulnerable installations and unusual file access patterns. Review logs for unauthorized file reads or writes in the metagpt/tools/libs/editor.py path. Check installed MetaGPT versions with pip show metagpt or grep -r 'metagpt' /usr/local/lib/python*/site-packages/. Look for suspicious file access attempts outside intended directories.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read sensitive files on your system that they should not have access to. Since the attack is launched locally, it requires the attacker to already have some level of access to your machine. The impact is limited as it does not allow file modification or code execution.

Mitigation Strategies

Immediately upgrade MetaGPT to a version beyond 0.8.2 if available. If no patch exists, disable or uninstall MetaGPT. Restrict local user permissions to limit file access. Monitor system logs for unusual file access attempts. Consider isolating systems running MetaGPT from sensitive networks until patched.

Hi! I’m here to help you understand CVE-2026-19059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70