{"id":"CVE-2026-91989","aliases":["EUVD-2026-78660","GHSA-p4ww-qqmg-mcg4","GHSA-rm43-82j9-r4mj"],"status":"published","title":"atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py","description":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01332,"percentile":0.71489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-13T14:17:13Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"PyPI","package":"atomic-agents-stack","fixed_in":["1.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"atomic-agents-stack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"atomic-agents-stack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"versions":["1.0.0"]}],"products":[{"vendor":"dep0we","product":"atomic-agents-stack"}],"references":[{"url":"https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-path-traversal-via-dashboard-serve-py","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91989","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p4ww-qqmg-mcg4"},{"url":"https://github.com/dep0we/atomic-agents-stack/commit/ec474f458122c5c0ca718d0df3078c8080338b2c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rm43-82j9-r4mj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91989.json","tags":["advisory"]},{"url":"https://github.com/dep0we/atomic-agents-stack","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-91989","title":"atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py","description":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.","status":"published","published":"2026-09-15T15:18:31.038Z","modified":"2026-09-17T19:27:51.603Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-78660","description":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.","status":"published","published":"2026-09-15T15:18:31Z","modified":"2026-09-17T19:27:51Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:09.684322Z"}],"ghsa":[{"id":"GHSA-p4ww-qqmg-mcg4","title":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP...","description":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.","status":"published","published":"2026-09-15T18:32:31Z","modified":"2026-09-15T18:32:42Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:11:54.818367Z"},{"id":"GHSA-rm43-82j9-r4mj","title":"atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read","description":"The optional dashboard HTTP server (`atomic_agents/dashboard/serve.py`) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through `_io.safe_resolve_under`. Literal `../` segments survive `urlparse` and `Path` joining, so a request can read files outside the intended `agents_root` (including via the static branch).\n\n**Impact:** arbitrary file read. The default bind is loopback, but `--host` is an operator-settable documented flag; binding `0.0.0.0` exposes this to the LAN. Even on loopback it is reachable via DNS-rebinding from a browser or SSRF from a co-located service.\n\n**Affected:** `dashboard/serve.py` (`DashboardHandler.do_GET` / `_serve_file`), all versions through 1.0.0.\n\n**Fix:** route every served path through `_io.safe_resolve_under` against the intended root and return 404 on `PathTraversalError`; reject `..`/separators early; optionally refuse a non-loopback `--host` unless an explicit auth/allow flag is set (matching `serve/_app.py`).","status":"published","published":"2026-08-13T14:17:13Z","modified":"2026-08-13T14:17:14Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-91989","description":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.","status":"published","published":"2026-09-15T16:17:58.01Z","modified":"2026-09-24T21:08:55.03Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-91989","title":"atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py","description":"atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.","status":"published","published":"2026-09-15T15:18:31.038Z","modified":"2026-10-28T02:30:52.143374377Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"GHSA-rm43-82j9-r4mj","title":"atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read","description":"The optional dashboard HTTP server (`atomic_agents/dashboard/serve.py`) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through `_io.safe_resolve_under`. Literal `../` segments survive `urlparse` and `Path` joining, so a request can read files outside the intended `agents_root` (including via the static branch).\n\n**Impact:** arbitrary file read. The default bind is loopback, but `--host` is an operator-settable documented flag; binding `0.0.0.0` exposes this to the LAN. Even on loopback it is reachable via DNS-rebinding from a browser or SSRF from a co-located service.\n\n**Affected:** `dashboard/serve.py` (`DashboardHandler.do_GET` / `_serve_file`), all versions through 1.0.0.\n\n**Fix:** route every served path through `_io.safe_resolve_under` against the intended root and return 404 on `PathTraversalError`; reject `..`/separators early; optionally refuse a non-loopback `--host` unless an explicit auth/allow flag is set (matching `serve/_app.py`).","status":"published","published":"2026-08-13T14:17:13Z","modified":"2026-09-16T03:56:03.982056126Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}