The optional dashboard HTTP server (atomic agents/dashboard/serve.py) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.safe resolve under. Literal ../ segments survive urlparse and Path joining, so a request can read files outside the intended agents root (including via the static branch).

Impact: arbitrary file read. The default bind is loopback, but --host is an operator-settable documented flag; binding 0.0.0.0 exposes this to the LAN. Even on loopback it is reachable via DNS-rebinding from a browser or SSRF from a co-located service.

Affected: dashboard/serve.py (DashboardHandler.do GET / serve file), all versions through 1.0.0.

Fix: route every served path through io.safe resolve under against the intended root and return 404 on PathTraversalError; reject ../separators early; optionally refuse a non-loopback --host unless an explicit auth/allow flag is set (matching serve/ app.py).