CyberRota Analysis
AI-GeneratedAgentScope versions up to 2.0.7.post1 are vulnerable to a path traversal flaw that allows attackers to exploit the skill_path request parameter to copy arbitrary server directories into the agent workspace. This could lead to unauthorized access to sensitive files within the skills directory. Organizations using affected versions should prioritize patching this vulnerability to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.