CVE-2026-51853

Summary

The agent-zero application suffers from a directory traversal vulnerability that allows unauthorized access to any file on the system through the FileBrowser component. This flaw enables attackers to read sensitive files without authentication or authorization.

Exploitability

Exploitation is straightforward with no special preconditions required, as the vulnerability exists in the default configuration and allows unrestricted file access.

Blast radius

The impact could be significant as attackers can potentially access configuration files, credentials, logs, and other sensitive system files that may contain authentication tokens, API keys, or database connection details.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to agent-zero version 1.11 or later which includes the fix for the directory traversal vulnerability in python/helpers/file_browser.py.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.