PT-2026-85571 · Agentscope Ai · Agentscope
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Agentscope