CVE-2026-51853
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host r…
Published: 2026-09-30 · CVSS: 7.5 · CVSS 3.1
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7