CVE-2026-15331
zhayujie CowAgent Skill Installation service.py _add_package path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 10, 2026
- Updated
- Jul 10, 2026
- Reserved
- Jul 9, 2026
Description
A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated remotely. Upgrading to version 2.1.2 is sufficient to fix this issue. The identifier of the patch is e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. It is advisable to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C | VulDB |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C | VulDB |
| 2.0 | 5.5 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
CowAgentzhayujie |
|
References
- VDB-377274 | zhayujie CowAgent Skill Installation service.py _add_package path traversalvdb-entrytechnical-description
- VDB-377274 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-15331 | CVE Analysis and Reportthird-party-advisory
- Submit #853104 | zhayujie CowAgent <= 2.1.0 Improper Limitation of a Pathname to a Restricted Directory (CWE-22)third-party-advisory
- https://github.com/zhayujie/CowAgent/issues/2873issue-tracking
- https://github.com/zhayujie/CowAgent/pull/2886issue-trackingpatch
- https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264patch
- https://github.com/zhayujie/CowAgent/releases/tag/2.1.2patch
- https://github.com/zhayujie/CowAgent/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.