Executive brief
The atomic-agents-stack package includes an optional web-based dashboard that serves files from a designated directory. A path traversal vulnerability allows remote attackers to read arbitrary files on the system by crafting malicious requests with directory traversal sequences (../) that bypass path containment checks. An attacker can access sensitive files outside the intended directory, potentially exposing credentials, configuration data, or other confidential information.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the dashboard HTTP server's DashboardHandler.do_GET endpoint. The root cause is that filesystem paths are constructed directly from the request path without proper containment validation, and literal ../ sequences are not neutralized by urlparse and Path joining operations. The affected code is in atomic_agents/dashboard/serve.py (_serve_file method). An unauthenticated, network-accessible attacker can exploit this by sending HTTP requests with ../ segments to read files outside the intended agents_root directory. The default bind address is loopback (127.0.0.1), but the --host flag allows configuration to bind to 0.0.0.0 or other addresses, expanding exposure to LANs or internet. Even on loopback, the vulnerability is reachable via DNS rebinding attacks or SSRF from co-located services. The fix is available in version 1.1.0, which routes all served paths through the _io.safe_resolve_under function with proper PathTraversalError handling.
Affected products
- dep0we atomic-agents-stack before 1.1.0
Timeline
- 2026-06-10: disclosed: GitHub Security Advisory (GHSA-rm43-82j9-r4mj) published
- 2026-09-15: advisory: CVE-2026-91989 assigned
- 2026-06-10: patched: Fix available in version 1.1.0