Code Execution via Path Traversal in crewai-tools

Executive Summary

This vulnerability is a path traversal issue in the FileWriterTool component of crewai-tools versions up to 1.10.2rc1. It allows a remote attacker to execute arbitrary code by providing malicious path traversal sequences in the filename argument, which can write files outside the intended directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses crewai-tools version <= 1.10.2rc1. Inspect FileWriterTool implementations for improper path handling, such as unvalidated use of os.path.join or os.makedirs. Look for directory traversal attempts in logs or file operations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write malicious files to unintended locations on your system, potentially leading to code execution, data theft, or system compromise if the attacker gains control over file content or paths.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes outside intended directories, potentially exposing sensitive data. For GDPR, this may violate Article 32 (security of processing) if personal data is compromised. For HIPAA, it could breach the Security Rule by allowing unauthorized access to protected health information. Compliance depends on whether the affected system processes regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Update crewai-tools to a version that includes the patch for CVE-2026-37007. Ensure FileWriterTool uses the new base_dir parameter with os.path.realpath() and Path.is_relative_to() checks. Validate all file paths to prevent traversal outside intended directories.

Useful 0 Not Useful 0