Executive brief
Mage AI is a data pipeline orchestration platform with a browser API for file system access. The browser-items API endpoint fails to restrict file paths to the project directory, allowing users with read-only "Viewer" permissions to read any file accessible to the server process by providing absolute paths. This breaks the role-based access control model intended to isolate project data.
Technical details
The vulnerability is a path traversal flaw in BrowserItemResource.py (mage_ai/api/resources/). The resource accepts caller-supplied file paths via the browser-items API but fails to apply path containment validation, unlike the sibling FileContentResource and FileResource classes which both call a containment helper. An authenticated user with Viewer role can supply an absolute path to read files outside the project directory that the server process can access. The default configuration does not enforce role-based permission checks on this endpoint (permission enforcement defaults to false), allowing the boundary violation. Users with Editor role can additionally write files, though Editor already has code execution capability; the primary impact is unauthorized read access for Viewer-role users.
Affected products
- Mage AI Mage AI up to 0.9.79
Timeline
- 2026-08-26: disclosed