CVE-2026-91989
atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 15, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 15, 2026
Description
atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
atomic-agents-stackdep0we |
|
References
- GitHub Security Advisory (GHSA-rm43-82j9-r4mj)vendor-advisory
- VulnCheck Advisory: atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.pythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.