PT-2026-25871 · Frdel · Agent0Ai+1

Eric-Y + 1 · Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-4307

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions frdel/agent0ai agent-zero version 0.9.7-10

Description A security flaw exists in the get abs path function within the python/helpers/files.py file of agent-zero. This flaw allows for path traversal, potentially enabling remote attacks. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 0.9.7-10 are potentially affected. As a temporary workaround, consider restricting access to the get abs path function until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2026-07916

CVE-2026-4307

Produtos afetados

Agent-Zero

Agent0Ai

Referências · 10

• 🔥 https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022 · Exploit
• https://vuldb.com/?id.351337 · Nota
• https://vuldb.com/?submit.771967 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4307 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-07916 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2033815022812475553 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2033814430761324694 · Publicação no Twitter
• https://vuldb.com/?ctiid.351337 · Nota
• https://twitter.com/CVEarity/status/2033799555305877733 · Publicação no Twitter
• https://t.me/cveNotify/155583 · Publicação no Telegram