PT-2026-25872 · Frdel · Agent0Ai

Eric-Y + 1 · Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-4308

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions frdel/agent0ai agent-zero version 0.9.7

Description A server-side request forgery condition exists in the handle pdf document function within the python/helpers/document query.py file. This manipulation can be carried out remotely. The exploit has been made publicly available. The vendor was contacted regarding this issue but did not respond. The API endpoint is not specified. The vulnerable parameter is not specified.

Recommendations Versions prior to 0.9.7 are affected. As a temporary workaround, consider disabling the handle pdf document() function until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4308

Affected Products

Agent0Ai

References · 11

• 🔥 https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4308 · Security Note
• https://twitter.com/vuldb/status/2034292136083116161 · Twitter Post
• https://vuldb.com/?submit.773950 · Note
• https://twitter.com/cyberbivash/status/2033813584761811042 · Twitter Post
• https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989 · Note
• https://t.me/cveNotify/155584 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2033812462697394199 · Twitter Post
• https://vuldb.com/?ctiid.351338 · Note
• https://twitter.com/CVEarity/status/2033799635849105773 · Twitter Post
• https://vuldb.com/?id.351338 · Note