CVE-2026-29870

Name of the Vulnerable Software and Affected Versions agentic-context-engine versions prior to 0.7.2

Description A directory traversal issue allows arbitrary file writes through the checkpoint dir parameter in the OfflineACE.run function. The save to file() method in ace/skillbook.py does not normalize or validate filesystem paths, enabling traversal sequences to escape the designated checkpoint directory. This can lead to the overwriting of arbitrary files accessible to the application process, potentially resulting in application corruption, privilege escalation, or code execution.

Recommendations Update to a version newer than 0.7.1. As a temporary workaround, restrict or validate the input provided to the checkpoint dir parameter to prevent the use of traversal sequences.