CVE-2026-91989CWE-22path-traversal

CVE-2026-91989

High · published September 15, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01332 · 70.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-15T20:17Z
References (2)
https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj · [email protected]https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-path-traversal-via-dashboard-serve-py · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 15 SEP 15:18Z
    atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
    cvelistv5