Vulnerability · Published Mar 17, 2026 · Assigned by VulDB

CVE-2026-4307frdel/agent0ai agent-zero files.py get_abs_path path traversal

Medium 4.3

In plain English

A medium-severity path traversal in agent-zero from agent0ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.py. The manipulation results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
frdel	agent-zero	0.9.7-10
agent0ai	agent-zero	0.9.7-10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-351337 | frdel/agent0ai agent-zero files.py get_abs_path path traversal vdb-entry, technical-description
VDB-351337 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #771967 | frdel agent-zero 0.9.7-10 Path Traversal (CWE-22) third-party-advisory
https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022 exploit