CVE-2026-51570

Summary

The flaw allows path traversal in insert_text_file, enabling an attacker to access or modify files outside the intended directory. This matters because it can lead to data leakage or unauthorized file manipulation.

Exploitability

Exploitation is moderately hard as it requires knowledge of the specific file paths and potential user interaction. Precondition is the target must be running an affected version of Agentscope.

Blast radius

If exploited, the impact could be significant, as it allows access to sensitive files, potentially leading to data breaches or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to modelscope Agentscope v1.0.9 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.