Log in Start free

Vulnerability · Published Apr 10, 2026 · Assigned by VulDB

CVE-2026-5998zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal

Medium 5.3

In plain English

A medium-severity path traversal in chatgpt-on-wechat CowAgent from zhayujie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 49.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.0.5 mitigates this issue. Patch name: 174ee0cafc9e8e9d97a23c305418251485b8aa89. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected products (as reported)

VendorProductVersions
zhayujie chatgpt-on-wechat CowAgent 2.0.02.0.12.0.22.0.32.0.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

References