Quick answers
- Is CVE-2026-47118 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47118 being exploited in the wild.
- How severe is CVE-2026-47118?
- Medium severity, with a CVSS score of 6.5, published 27 May 2026.
- Which products and versions are affected?
- Agent0ai Agent Zero < 1.15.
- Is there a fix for CVE-2026-47118?
- A patch was published on 2026-05-12: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-47118 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-47118?
- Check whether you run Agent0ai Agent Zero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the `/api/image_get` endpoint of Agent Zero before version 1.15. The root cause is the explicit disabling of path containment checks (is_in_base_dir) in the `api/image_get.py` handler, relying instead on a file extension allowlist. An unauthenticated attacker can use directory traversal sequences or symlinks to read any file on the host system that has an image extension (e.g., .jpg, .png, .svg). Furthermore, because SVG files are served with the `image/svg+xml` MIME type without a restrictive Content Security Policy (CSP), an attacker can perform a stored/reflected XSS attack to execute scripts in the context of the Agent Zero origin. The vulnerability is fixed in version 1.15 by re-enabling path resolution against the base directory and hardening SVG responses.
Affected products
- agent0ai Agent Zero < 1.15
Timeline
- 2026-05-07: disclosed: Issue reported on GitHub
- 2026-05-12: patched: Fix committed to repository
- 2026-05-27: advisory: NVD and VulnCheck advisories published