CVE-2026-51853

Name of the Vulnerable Software and Affected Versions agent-zero versions 1.7 through 1.10

Description A directory traversal issue exists in the FileBrowser. init function within the python/helpers/file browser.py file. The FileBrowser class initializes using the host root directory as the workspace, which allows the agent to access any file on the system without restriction.

Recommendations Update agent-zero to a version later than 1.10. As a temporary mitigation, restrict the workspace initialization in the FileBrowser. init function to a specific, non-root directory.