Executive brief
Agent Zero, an AI agent framework, contains a security flaw in how it handles requests for image files. An unauthenticated attacker can trick the system into reading sensitive files from the server's disk or executing malicious scripts in a user's browser via specially crafted image paths. This could lead to the exposure of private data or unauthorized access to the application's management interface.
Technical details
A path traversal vulnerability exists in the `/api/image_get` endpoint of Agent Zero before version 1.15. The root cause is the explicit disabling of path containment checks (is_in_base_dir) in the `api/image_get.py` handler, relying instead on a file extension allowlist. An unauthenticated attacker can use directory traversal sequences or symlinks to read any file on the host system that has an image extension (e.g., .jpg, .png, .svg). Furthermore, because SVG files are served with the `image/svg+xml` MIME type without a restrictive Content Security Policy (CSP), an attacker can perform a stored/reflected XSS attack to execute scripts in the context of the Agent Zero origin. The vulnerability is fixed in version 1.15 by re-enabling path resolution against the base directory and hardening SVG responses.
Affected products
- agent0ai Agent Zero < 1.15
Timeline
- 2026-05-07: disclosed: Issue reported on GitHub
- 2026-05-12: patched: Fix committed to repository
- 2026-05-27: advisory: NVD and VulnCheck advisories published