CVE-2026-58499

Name of the Vulnerable Software and Affected Versions EverOS versions prior to 1.0.1

Description EverOS contains a path traversal flaw in the '/api/v1/memory/add' endpoint. The issue occurs because the sender id field is not validated as a path-safe identifier. During user-memory extraction, the sender id is used as an owner id and incorporated into the filesystem path where episodes are saved as Markdown files. An unauthenticated caller can use ../ sequences within the sender id to direct writes outside the configured memory root, enabling the creation or overwriting of .md files in locations writable by the server process with partially attacker-influenced content.

Recommendations Update EverOS to version 1.0.1. Avoid using the sender id parameter in the '/api/v1/memory/add' endpoint until the update is applied.