PT-2026-25871 · Frdel · Agent0Ai+1

Eric-Y + 1 · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-4307

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions frdel/agent0ai agent-zero version 0.9.7-10

Description A security flaw exists in the get abs path function within the python/helpers/files.py file of agent-zero. This flaw allows for path traversal, potentially enabling remote attacks. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 0.9.7-10 are potentially affected. As a temporary workaround, consider restricting access to the get abs path function until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4307

Affected Products

Agent-Zero

Agent0Ai

References · 9

• 🔥 https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4307 · Security Note
• https://t.me/cveNotify/155583 · Telegram Post
• https://vuldb.com/?submit.771967 · Note
• https://twitter.com/CVEarity/status/2033799555305877733 · Twitter Post
• https://vuldb.com/?ctiid.351337 · Note
• https://vuldb.com/?id.351337 · Note
• https://twitter.com/cyberbivash/status/2033814430761324694 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033815022812475553 · Twitter Post