CVE-2026-55747
Received Received - Intake

Path Traversal in PocketFlow Coding Agent

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a `_path(workdir, p)` helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because os.path.join returns an absolute `p` unchanged (ignoring workdir) and does not resolve '../' sequences, an agent invocation whose file-tool arguments include an absolute path or a traversal sequence can read or write files outside the configured working directory. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-55747
EUVD
EUVD-2026-53195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the-pocket pocket_flow *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability involves a helper function `_path(workdir, p)` in the PocketFlow framework's cookbook example. This function uses `os.path.join` without canonicalization or containment checks. It fails to handle absolute paths or '..' traversal sequences properly, allowing file access outside the intended working directory when used by tools like ReadFile or ListFiles.

Detection Guidance

Check for file-access tools using unguarded path helpers in PocketFlow agents. Inspect agent configurations for ReadFile, ListFiles, PatchRead, or PatchApply calls with absolute paths or '../' sequences. Review custom cookbook examples for improper path handling.

Impact Analysis

An attacker could exploit this to read or modify files outside the configured working directory by providing absolute paths or traversal sequences in file tool arguments. This could lead to unauthorized data access, system compromise, or data corruption if the application uses this cookbook pattern in production.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data (e.g., personal or health information). GDPR requires protecting personal data, while HIPAA mandates securing health information. Exploitation could lead to data breaches, resulting in legal penalties or reputational damage.

Mitigation Strategies

Replace the _path helper with os.path.abspath and validate paths stay within workdir. Add containment checks for traversal sequences. Audit all agent file-access tools for similar patterns and update to use secure path resolution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart