Executive brief
The atomic-agents-stack dashboard HTTP server builds file paths directly from user requests without proper containment checks, allowing attackers to read arbitrary files from the system. While the default configuration binds only to localhost, the server can be configured to listen on broader network interfaces (e.g., 0.0.0.0), potentially exposing sensitive files to LAN attackers. Even on localhost, the vulnerability is exploitable via DNS-rebinding attacks or SSRF from co-located services.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the dashboard HTTP server component (`atomic_agents/dashboard/serve.py`, functions `DashboardHandler.do_GET` and `_serve_file`). The root cause is that filesystem paths are constructed directly from request URLs using `urlparse` and `Path` operations without validating that the resolved path stays within the intended `agents_root` directory. Literal `../` path segments survive these operations, permitting attackers to read files outside the intended root. The attack vector is network-based (HTTP requests), requires no authentication or user interaction, and can be triggered from a remote network even if the server binds to loopback (via DNS-rebinding or SSRF). An attacker can achieve arbitrary file read, potentially exposing configuration files, credentials, and other sensitive data. The fix, included in version 1.1.0, routes all served paths through the existing `safe_resolve_under` function, which properly neutralizes path traversal, and returns 404 on detection of traversal attempts.
Affected products
- dep0we atomic-agents-stack <= 1.0.0
Timeline
- 2026-06-10: disclosed: Vulnerability disclosed and patch published
- 2026-06-10: patched: Fixed in version 1.1.0 via commit ec474f4