GHSA-RM43-82J9-R4MJ: Path Traversal (Arbitrary File Read) in atomic-agents-stack Dashboard
Vulnerability ID: GHSA-RM43-82J9-R4MJ
CVSS Score: 8.2
Published: 2026-08-13
A path traversal vulnerability in the optional dashboard server of atomic-agents-stack before version 1.1.0 allows unauthenticated remote attackers to read arbitrary files from the host filesystem.
TL;DR
Unauthenticated remote path traversal in atomic-agents-stack dashboard allows arbitrary file read.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network
- CVSS v4.0: 8.2 (High)
- EPSS Score: Not Applicable
- Impact: Arbitrary File Read
- Exploit Status: Proof of Concept (PoC)
- KEV Status: Not Listed
Affected Systems
- atomic-agents-stack
-
atomic-agents-stack: <= 1.0.0 (Fixed in:
1.1.0)
Code Analysis
Commit: ec474f4
Secure file serving by routing paths through safe_resolve_under validation checks.
Exploit Details
- GitHub Fix Commit Test Suite: Comprehensive integration security test suite (test_dashboard_serve_security.py) verifying regression resistance.
Mitigation Strategies
- Upgrade the atomic-agents-stack library to version 1.1.0 or newer.
- Bind the dashboard listener interface to loopback (127.0.0.1) instead of all interfaces.
- Execute the application process using a dedicated low-privilege user account.
Remediation Steps:
- Run 'pip install --upgrade atomic-agents-stack>=1.1.0' to update the package.
- Verify that the --host parameter is not set to 0.0.0.0 when starting the dashboard.
- Audit application environments for exposure of sensitive environment variables or keys.
References
Read the full report for GHSA-RM43-82J9-R4MJ on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)