CVE-2026-51851

Agent Zero file editing can write outside the intended work directory

Agent Zero maintainers · Agent Zero FileBrowser.save_text_file

First documented disclosure · Review checkpoint

Summary

The reported file-editing path can write arbitrary locations accessible to the service process.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: The researcher reports authorized local HTTP validation and a marker-file write. No reviewed source establishes malicious exploitation or a confirmed production victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The report describes a root base directory that makes the resolved-path prefix check ineffective for user-supplied save paths.

Conditions required

Access to the edit_work_dir_file HTTP route, a valid CSRF token in the demonstrated setup and filesystem write permission for the service. Public unauthenticated reachability is not established.

Potential impact

Out-of-work-directory file writes and possible overwrite of accessible configuration or executable files; later execution requires an additional step.

Affected versions and configurations

The CNA and researcher list 1.7, 1.8, 1.9 and 1.10; correspondence with upstream tagged releases is not established.

Fix and mitigation status

No verified fixed release in the reviewed sources.

Practical next steps

Restrict the UI and file-edit route to trusted operators, constrain service filesystem permissions and enforce a canonical workspace boundary. Obtain an upstream issue-specific fix before relying on a version label.

Operating lesson

A path check against the filesystem root does not confine an agent to its workspace.

Evidence and limits

The April 20 issue predates the September 26 researcher gist and October 29 CNA. It was closed July 24 by an inactivity bot, which is not evidence of remediation. The CNA names modelscope agent-zero, while its references point to agent0ai; vendor naming and release mapping remain uncertain. The published record provides no CVSS score.

Sources