CVE-2026-51853

EUVD-2026-90425
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 56.24%
Common Weakness Enumeration
References
https://gist.github.com/Ro1ME/4fe09fc7f94c9c0b10c8b6198a70e920
https://github.com/agent0ai/agent-zero/issues/1539
https://github.com/agent0ai/agent-zero/issues/1539