CVE-2026-4308

MEDIUM

frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery

Title source: cna

Description

A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Signature, Permissions Required signature permissions-required

VDB-351338 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/?ctiid.351338

Third Party Advisory third-party-advisory

Submit #773950 | agent0ai agent-zero 0.9.7 Server-Side Request Forgery (CWE-918)

https://vuldb.com/?submit.773950

Exploit exploit

https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc

Vdb Entry, Technical Description vdb-entry technical-description

VDB-351338 | frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery

https://vuldb.com/?id.351338

Scores

CVSS v3 6.3

EPSS 0.0020

EPSS Percentile 10.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (2)

agent0ai/agent-zero 0.9.7

frdel/agent-zero 0.9.7

Published Mar 17, 2026

Tracked Since Mar 17, 2026