CVE-2026-4308
frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 17, 2026
- Updated
- Mar 17, 2026
- Reserved
- Mar 16, 2026
Description
A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
agent-zerofrdel |
|
agent-zeroagent0ai |
|
References
- VDB-351338 | frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgeryvdb-entrytechnical-description
- VDB-351338 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #773950 | agent0ai agent-zero 0.9.7 Server-Side Request Forgery (CWE-918)third-party-advisory
- https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989related
- https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#pocexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.