Directory Traversal in Devika AI Agent Framework

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: MITRE

Description

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-51873

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Devika v1.0 has a Directory Traversal vulnerability in the Coder.save_code_to_project function. This flaw allows attackers to write files outside the intended project workspace, potentially accessing or overwriting sensitive system files.

Impact Analysis

This vulnerability could allow attackers to overwrite critical system files, execute malicious code, or access sensitive data stored outside the project directory. It may lead to system compromise or data breaches depending on the attacker's goals.

Mitigation Strategies

Update Devika to the latest version that patches the Directory Traversal vulnerability in Coder.save_code_to_project. If no patch is available, restrict file write permissions to prevent unauthorized directory access.

Hi! I’m here to help you understand CVE-2026-51873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70