PT-2026-57079 · Zhayujie · Cowagent
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
zhayujie CowAgent versions prior to 2.1.2
Description
In the Skill Installation Handler component, the
add url() and add package() functions within the agent/skills/service.py file are susceptible to path traversal. This occurs when the Name argument is manipulated, allowing a remote attacker to access or overwrite files outside the intended directory.Recommendations
Upgrade to version 2.1.2.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cowagent