CVE-2026-4307

MEDIUM

frdel/agent0ai agent-zero files.py get_abs_path path traversal

Title source: cna

Description

A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.py. The manipulation results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-351337 | frdel/agent0ai agent-zero files.py get_abs_path path traversal

https://vuldb.com/?id.351337

Signature, Permissions Required signature permissions-required

VDB-351337 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/?ctiid.351337

Third Party Advisory third-party-advisory

Submit #771967 | frdel agent-zero 0.9.7-10 Path Traversal (CWE-22)

https://vuldb.com/?submit.771967

Exploit exploit

https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022

Scores

CVSS v3 4.3

EPSS 0.0036

EPSS Percentile 27.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (2)

agent0ai/agent-zero 0.9.7-10

frdel/agent-zero 0.9.7-10

Published Mar 17, 2026

Tracked Since Mar 17, 2026